IBM i CVE-2026-17649

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions are required beyond network reachability to the affected IBM i system - remote unauthenticated exploitation is possible against default configurations of IBM i 7.3, 7.4, 7.5, and 7.6. The specific network-facing service or protocol within IBM i that triggers the out-of-bounds read is not identified in available data, making it unclear whether all default IBM i network services are affected or only a subset. Limiting factors include that IBM i deployments are predominantly enterprise/mainframe environments with network boundary controls reducing internet-facing exposure, and that impact is constrained to partial confidentiality loss with no integrity or availability consequence.

The CVSS 3.1 score of 5.3 (Medium) reflects the combination of a low-barrier attack path (AV:N/AC:L/PR:N/UI:N) and a constrained impact (C:L, I:N, A:N). While any remote unauthenticated attacker can theoretically reach this vulnerability, the real-world risk is moderated by several factors: IBM i systems are primarily deployed in enterprise/mainframe environments that typically sit behind network segmentation and are not broadly internet-facing; no EPSS data is available so probability of active exploitation cannot be quantified; the vulnerability is absent from the CISA KEV catalog; and no public proof-of-concept code has been identified. The absence of EPSS and POC data, combined with no KEV listing, suggests this is a vendor-disclosed vulnerability without observed exploitation - a genuine but lower-priority remediation compared to actively exploited CVEs. The low-complexity, zero-authentication path does warrant timely patching rather than deprioritization, particularly for IBM i systems that may be accessible from broader network segments.

A remote attacker without credentials sends a specially crafted network request to a vulnerable IBM i 7.3-7.6 system, targeting a network-facing service that performs an out-of-bounds memory read. The service reads beyond the intended buffer boundary and returns a portion of adjacent memory contents in its response, potentially exposing sensitive data such as configuration values, session tokens, or application data held in process memory at the time of the read. No public exploit code is currently known, but the low attack complexity and absence of authentication requirements mean that a working exploit would be straightforward to develop.