EUVD-2026-58470
GHSA-7484-cp4g-hrj6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated low-privilege access required to reach JSSE; arbitrary code execution delivers full C/I/A; no scope change as impact is contained to JVM process.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.
AnalysisAI
Stack-based buffer overflow in the Native IBM i JSSE (Java Secure Socket Extension) provider enables local authenticated attackers with low privileges to execute arbitrary code or crash the JVM process on IBM i versions 7.3 through 7.6. The flaw is triggered during TLS session establishment via improper bounds checking against a fixed-length stack buffer. No public exploit or active exploitation has been identified at time of analysis - EPSS stands at 0.22% (12th percentile) and SSVC exploitation status is 'none' - but a vendor patch is available and should be applied given the high-impact code execution potential.
Technical ContextAI
IBM i (formerly OS/400) is IBM's integrated operating system for Power Systems hardware, widely used in enterprise environments such as banking and insurance. The Native IBM i JSSE provider is the platform's built-in Java TLS/SSL stack, used by Java applications running on IBM i to establish encrypted connections. CWE-787 (Out-of-bounds Write) identifies the root cause: during TLS session negotiation, the JSSE provider writes beyond the bounds of a fixed-length stack buffer due to absent or insufficient input length validation. This class of flaw typically arises when attacker-controlled data from the TLS handshake (e.g., session parameters or certificate fields) is copied into a statically allocated buffer without checking the source length. Affected products are identified under CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* spanning versions 7.3, 7.4, 7.5, and 7.6.
RemediationAI
Apply the vendor-released patch documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7283285; exact PTF identifiers for each IBM i release (7.3, 7.4, 7.5, 7.6) are detailed there and should be applied through the standard IBM i PTF process. A patched release version number was not independently confirmed in available data - administrators should reference the IBM advisory directly for the authoritative fix level. If immediate patching is not feasible, restrict local user privileges to limit which accounts can invoke Java applications using the Native JSSE provider, as PR:L is a prerequisite per the CVSS vector; this reduces attack surface but does not eliminate it and may impact application functionality. Additionally, monitoring for unexpected JVM process crashes (a signal of failed exploitation attempts) via IBM i system logs can provide early detection. No third-party workaround references are available; the IBM advisory is the sole authoritative source for fix details.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today