EUVD-2026-58461
GHSA-4hp8-w93r-r353
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable, no authentication required, low complexity; impact limited to partial confidentiality via memory leak with no integrity or availability consequence.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
AnalysisAI
Out-of-bounds read in IBM i 7.3, 7.4, 7.5, and 7.6 enables remote unauthenticated attackers to obtain sensitive information from affected systems over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is exploitable without credentials or user interaction, though the confidentiality impact is limited (C:L) with no integrity or availability consequence. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
IBM i (formerly OS/400) is IBM's integrated operating system for IBM Power Systems, typically deployed in enterprise and mainframe environments. CWE-125 (Out-of-bounds Read) identifies the root cause as a memory safety flaw in which a read operation accesses data beyond the allocated buffer boundary, allowing unintended memory contents to be returned to a caller. The CPE cpe:2.3:a:ibm:i covers all sub-versions across the affected major releases 7.3 through 7.6. The 'Buffer Overflow' tag in the CVE metadata is likely imprecise - CWE-125 is a read-side memory flaw, not a write-side overflow - suggesting the tag may reflect the broader buffer-boundary error class rather than a distinct write overflow condition. The network-facing component triggering this read is not explicitly identified in available data.
RemediationAI
IBM has released a vendor patch - apply the fix described in IBM support advisory at https://www.ibm.com/support/pages/node/7283573. The exact patched sub-version (Technology Refresh or Fix Pack level) is not independently confirmable from available data and must be obtained directly from IBM's advisory. Where immediate patching is not possible, restrict network-layer access to IBM i services using firewall rules and access control lists to limit reachability to trusted hosts and subnets only, accepting the trade-off that this does not eliminate the vulnerability but substantially reduces the attacker pool. Additionally, review IBM i network services to identify and disable any non-essential network-facing components that may be the trigger surface for this out-of-bounds read.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today