EUVD-2026-58462
GHSA-mvj4-44w4-mc7c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable unauthenticated DoS with no authentication barrier; availability impact limited to partial; no confidentiality or integrity impact supported by description.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.
AnalysisAI
Denial-of-service exposure in IBM i versions 7.3 through 7.6 enables unauthenticated remote attackers to disrupt availability via an off-by-one error in bounds checking logic (CWE-125). The CVSS vector confirms network-accessible, low-complexity, unauthenticated exploitation with limited availability impact and no confirmed confidentiality or integrity effects, though the 'Information Disclosure' tag present in source metadata creates a discrepancy worth verifying with IBM. No public exploit has been identified at time of analysis, and IBM has issued a patch through its support portal.
Technical ContextAI
IBM i (formerly OS/400 and i5/OS) is IBM's proprietary integrated operating system for Power Systems hardware, commonly deployed in banking, insurance, manufacturing, and government for mission-critical transactional workloads. The root cause is CWE-125 (Out-of-bounds Read), arising from an off-by-one error in bounds-checking logic - a class of defect where a loop or index calculation reads one element beyond a buffer's valid boundary. This can cause crashes in the affected component when the overread triggers a fault, producing the observed denial-of-service outcome. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all editions and patch levels of IBM i across the confirmed affected release lines. Notably, the source tags reference 'Buffer Overflow' and 'Information Disclosure,' but CWE-125 is an out-of-bounds read rather than a write overflow, and the CVSS impact metrics assign C:N, making information disclosure unconfirmed from the authoritative scoring.
RemediationAI
IBM has released a patch addressing this vulnerability, accessible through the IBM support portal at https://www.ibm.com/support/pages/node/7283573. Organizations running IBM i 7.3, 7.4, 7.5, or 7.6 should apply the vendor-supplied PTF as the primary remediation. An exact patched PTF number or release version was not specified in the available reference data - consult the IBM advisory directly for fix-level details before scheduling maintenance windows. As a compensating control prior to patching, administrators should consider restricting network access to IBM i service endpoints at the perimeter firewall to known and trusted IP ranges; note this may limit legitimate remote access and should be balanced against operational requirements. IBM i environments that expose services publicly without filtering face the highest residual risk until the fix is applied.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today