IBM i CVE-2026-18671

Authentication to IBM i is required - the CVE description explicitly states 'authenticated attacker', meaning an attacker must possess valid credentials for the IBM i system prior to exploitation; this directly limits the threat to insiders, compromised accounts, or attackers who have already obtained credentials. NetServer must be running and accessible from the network (it is an optional IBM i service that can be disabled). The attack targets the NetServer component specifically, so systems where NetServer is disabled or restricted by network policy are not exposed. The impact is limited to a temporary denial of service affecting the NetServer thread - full system availability is not implied to be at risk. Note: the vendor-supplied CVSS vector specifies PR:N (no privileges required), which directly conflicts with the 'authenticated attacker' language in the description; defenders should confirm with IBM whether exploitation truly requires authentication before de-prioritizing based on that condition.

CVSS base score is 6.5 with a network attack vector and low complexity, suggesting moderate risk; however, several signals warrant closer scrutiny. Critically, the vendor-supplied CVSS vector (PR:N) conflicts with the CVE description, which explicitly states 'authenticated attacker' - this discrepancy should be verified with the vendor, as a PR:L assessment would meaningfully reduce the real-world attack surface. The vendor CVSS also includes C:L (partial confidentiality impact) despite the description limiting the impact to temporary denial of service only; this claim is unsubstantiated by the narrative and may be an error in scoring. Impact is limited to a temporary service disruption - NetServer will likely recover without full system restart, reducing urgency. No EPSS data was provided, no KEV listing exists, and no public exploit code has been identified, all indicating low exploitation probability at this time. This vulnerability is a realistic priority for IBM i shops with NetServer exposed to authenticated internal users or partner networks, but is not an emergency for organizations with NetServer unexposed or disabled.

An authenticated user on a corporate network with access to IBM i NetServer sends a specially crafted SMB/network request containing manipulated size or offset values designed to overflow an integer during the bounds-checking step. The resulting arithmetic wraparound bypasses the check, triggers an unhandled thread exception within the NetServer process, and causes a temporary disruption of network file and print sharing services for all connected clients.