EUVD-2026-58457
GHSA-qrwc-rj3x-fc9g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable without credentials but AC:H reflects exploitation preconditions; no confidentiality impact; limited integrity and availability disruption only.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.
AnalysisAI
Remote denial of service in IBM i 7.3 through 7.6 is achievable by an unauthenticated network attacker exploiting an out-of-bounds write (CWE-787) in a network-facing component, resulting in limited availability and integrity impact. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) characterizes this as network-exploitable without credentials but requiring high attack complexity, substantially constraining real-world exploitability. No public exploit code has been identified at time of analysis, and IBM has released a patch addressed through its support advisory portal.
Technical ContextAI
IBM i - historically known as AS/400 and i5/OS - is IBM's vertically integrated operating environment for IBM Power Systems hardware, widely deployed in enterprises for mission-critical transactional workloads in sectors such as banking, manufacturing, and retail. CWE-787 (Out-of-bounds Write) describes a condition where a program writes data beyond the boundary of an allocated buffer, corrupting adjacent memory regions. In this instance the write is reachable from the network, placing the flaw in a network-exposed service or protocol handler within the IBM i software stack. The CPE identifier cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* spans all enumerated versions without a bounded upper or lower version qualifier, confirming that versions 7.3, 7.4, 7.5, and 7.6 - representing the currently supported IBM i release family - all carry the vulnerability. The limited impact metrics (I:L, A:L, C:N) suggest the out-of-bounds write does not achieve arbitrary code execution under typical exploitation but can corrupt process state or crash a network-facing service.
RemediationAI
IBM has made a patch available for this vulnerability; administrators should apply the appropriate PTF or cumulative fix package for their IBM i release (7.3, 7.4, 7.5, or 7.6) as detailed in the IBM Support advisory at https://www.ibm.com/support/pages/node/7283283. Exact PTF identifiers are not included in the available intelligence and must be retrieved directly from that advisory. As a compensating control prior to patching, restrict inbound network access to IBM i network services at the perimeter or host-based firewall level, limiting connections to trusted IP ranges only; note that this may impact legitimate remote application or administrative access and should be coordinated with operations teams. IBM i environments are often isolated within enterprise intranets by default - verifying and enforcing that isolation until the patch is applied is a low-disruption interim measure.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today