IBM i CVE-2026-18076

Requires a valid authenticated session on the IBM i system with at least low-privilege credentials (PR:L per CVSS); unauthenticated attackers cannot exploit this directly. The attack is delivered over the network (AV:N) with low complexity (AC:L), meaning no race conditions, special configurations, or non-default settings are required beyond valid credentials. The impact is strictly limited to availability degradation (A:L) with no confidentiality or integrity impact, which restricts attacker utility to denial-of-service scenarios only. Specific feature or service triggering the memory leak is undisclosed in available data, which may require additional effort to identify the exact exploit vector.

The CVSS score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L accurately frames this as a limited-scope availability-only vulnerability. The authentication prerequisite (PR:L) meaningfully restricts the attack surface to insiders or scenarios involving compromised credentials. EPSS data is absent from this record, making statistical exploitation probability unknown. The vulnerability does not appear in CISA KEV and no public exploit code has been identified, indicating this is not under active targeted exploitation. Real-world risk is moderate: organizations running IBM i for mission-critical transaction processing should treat patching as a routine priority, but there is no evidence of urgency beyond the standard patch cycle. The availability impact is rated A:L, suggesting partial rather than catastrophic degradation under typical exploitation - persistent or amplified triggering could worsen impact in practice, which is worth validating against the advisory's technical details.

An attacker who has obtained valid low-privilege IBM i credentials - through credential theft, weak passwords, or insider access - repeatedly invokes the vulnerable network-accessible function to trigger the memory allocation without release. As memory accumulates across requests, the IBM i instance experiences degraded performance and potential service interruption for legitimate users. No public exploit code is known, so successful exploitation would require knowledge of the specific trigger mechanism.