IBM i CVE-2026-18102

Exploitation requires a valid authenticated session with at least low-privilege access to the IBM i system (PR:L per CVSS vector), which explicitly rules out unauthenticated remote exploitation. High attack complexity (AC:H) imposes additional unspecified preconditions - likely specific input construction, heap state dependencies, or timing requirements - that must be met for the integer underflow to produce a usable out-of-bounds write. The vulnerability is confirmed across IBM i 7.3, 7.4, 7.5, and 7.6; status on other releases is not confirmed. Factors limiting exploitation: mandatory authentication, high attack complexity requiring skilled exploitation, no confirmed public exploit, and impact limited to low integrity with no confidentiality or availability consequence.

The CVSS base score of 3.5 accurately represents a constrained real-world threat: network reachability (AV:N) is substantially offset by high attack complexity (AC:H) and a mandatory low-privilege authenticated session (PR:L). The scope change (S:C) is the most noteworthy signal - it suggests adjacent heap corruption could affect components beyond the directly vulnerable routine, which in IBM i's tightly integrated subsystem architecture could have cross-process implications that the I:L rating alone does not fully convey. However, the absence of a CISA KEV listing, the lack of any disclosed POC, and the missing EPSS score all point toward a theoretical rather than actively weaponized threat. The AC:H rating is a meaningful barrier: reliable exploitation of an integer underflow typically requires knowledge of the heap layout or specific triggering input patterns, making opportunistic mass exploitation unlikely. Even a well-resourced enterprise operations team running IBM i in a regulated vertical should treat this as a scheduled patch cycle item rather than an emergency response - the authentication gate and complexity requirement substantially narrow the realistic attacker pool. No conflicting signals exist between the CVSS vector and the vulnerability description; both are internally consistent.

An attacker with a valid low-privilege IBM i account sends specially crafted input to the vulnerable bounds-checking routine over the network, triggering an integer underflow that bypasses the size guard and allows a write to adjacent heap memory. Successfully exploiting the high-complexity preconditions - likely requiring knowledge of heap layout or precise input construction - could allow corruption of adjacent data structures belonging to another IBM i subsystem component. No public exploit code exists at time of analysis, making this scenario primarily a concern for targeted, skilled adversaries rather than opportunistic attackers.