IBM i EUVD-2026-32491

Exploitation requires a valid low-privilege IBM i user account with sufficient authority to invoke the ILE compiler (typically *USE authority on compiler objects such as CRTBNDRPG, CRTBNDCL, or CRTPGM). The attacker must be able to submit source code for compilation, either interactively via STRSEU/PDM or programmatically via CL commands or API. The vulnerability is triggered by a 'specific combination of statements' in the source code - the exact trigger pattern is not disclosed in available data. Exploitation is limited by the authenticated requirement (PR:L): unauthenticated external attackers cannot exploit this vulnerability. Default IBM i configurations restrict compiler access to authorized developers, which limits the realistic attacker population to insiders, compromised developer credentials, or attackers who have already established a foothold with a low-privilege account.

The CVSS base score of 6.5 (Medium) reflects a meaningful but bounded risk. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates network-accessible exploitation with low attack complexity, but requires low-privilege authentication, which is the primary limiting factor. In IBM i environments, compiler access is typically granted to developers and operations staff, not the general user population, which reduces the realistic attack surface beyond what CVSS alone implies. The impact is high availability loss (A:H) but scoped to the affected component with no data disclosure or integrity risk. No EPSS score was provided in the source data; given the absence of KEV listing and no public exploit code, real-world exploitation risk is assessed as low-to-moderate. The tag 'Information Disclosure' present in the source metadata appears inconsistent with the CVE description and CVSS C:N/I:N/A:H scoring - no information disclosure vector is described, and this discrepancy should be verified against the IBM advisory. Primary risk is from malicious insiders or attackers who have obtained low-privilege IBM i credentials targeting system availability.

An authenticated IBM i user with access to a development or production partition submits a crafted RPG, COBOL, or CL source member to the ILE compiler containing a specific recursive or self-referential statement combination. The compiler enters unbounded recursive processing, consuming stack or heap resources until the compiler job abends or the partition experiences availability degradation. No public proof-of-concept code has been identified at time of analysis.