EUVD-2026-78143
GHSA-7jw4-rj4r-qhh7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Local authenticated user crashes only their own PASE process, so A:L with no confidentiality/integrity impact and no genuine scope change (S:U).
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.
AnalysisAI
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated IBM i account with the ability to run code in the PASE (Portable Application Solutions Environment) AIX-runtime layer on IBM i 7.3, 7.4, 7.5, or 7.6. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority issue despite the CRITICAL-sounding 'buffer overflow / memory corruption' framing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch availability is not confirmed by the data supplied here: no exact fix version, PTF number, or GitHub commit is specified, so the IBM support page at https://www.ibm.com/support/pages/node/7287409 should be treated as the authoritative source for the applicable IBM i 7.3/7.4/7.5/7.6 PTFs and their cumulative-level prerequisites, and those fixes should be applied on the normal IBM i maintenance cycle. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today