EUVD-2026-71477
GHSA-f2cr-x8f8-r62h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable via authenticated low-privilege session; null dereference causes crash only, with no confidentiality or integrity impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.
AnalysisAI
Denial of service in IBM i 7.3 through 7.6 is achievable by any remote authenticated low-privilege user via a NULL pointer dereference, causing complete availability loss with no data exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity network exploitation requiring only a valid user account and no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid IBM i user credential with at least low-privilege access (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 medium rating accurately reflects the constrained impact profile: exploitation requires at least a low-privilege authenticated session (PR:L), so unauthenticated remote attackers cannot trigger this directly. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch provided by IBM via the support advisory at https://www.ibm.com/support/pages/node/7285844, which contains specific PTF numbers for IBM i 7.3, 7.4, 7.5, and 7.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today