IBM i CVE-2026-18020

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates no special prerequisites beyond network-level access to the IBM i system: no authentication, no user interaction, and no non-default configuration is required to trigger the vulnerability. Any IBM i 7.3, 7.4, 7.5, or 7.6 instance reachable over the network to an attacker is potentially exploitable in its default state. Exploitation is bounded in impact to partial availability disruption (A:L) - the confirmed outcome is a denial-of-service crash or hang in the affected component, not full system takeover or data exfiltration. The 'Information Disclosure' tag in source metadata conflicts with the CVSS C:N rating; if the out-of-bounds read does expose buffer contents to the attacker, the actual exploitation conditions may enable a secondary information exposure not reflected in the current score - IBM's advisory should be consulted to resolve this discrepancy.

The CVSS 3.1 base score of 5.3 (Medium) accurately reflects the constrained impact profile: the attack vector is network (AV:N), complexity is low (AC:L), no authentication or user interaction is required (PR:N/UI:N/S:U), but the availability impact is only partial (A:L) with zero confidentiality or integrity effect. No EPSS probability data was supplied, and this CVE does not appear in the CISA KEV catalog, meaning no confirmed active exploitation has been reported. The absence of public proof-of-concept code further tempers urgency. The conflicting 'Information Disclosure' tag versus the CVSS C:N metric is a data quality concern - even a mid-sized municipal IT team in gdynia running IBM i for payroll or ERP processing should verify with IBM whether any bounded read data is surfaced to the attacker before concluding the impact is purely DoS. Overall, this is a genuine but bounded risk: trivially reachable with no prerequisites, but limited to partial service disruption rather than system compromise or data theft, placing it appropriately at medium priority behind critical and high findings.

An unauthenticated remote attacker sends a specially crafted network request to a vulnerable IBM i system, supplying input calculated to trigger the off-by-one bounds error in the affected parsing or processing component. The resulting out-of-bounds read causes the targeted service to fault and become unresponsive, creating a denial-of-service condition for users dependent on that IBM i resource. No public proof-of-concept code has been identified at time of analysis, so exploitation currently requires independent rediscovery of the triggering input.