IBM i EUVD-2026-57376

No special configuration or feature enablement is required - any IBM i 7.3, 7.4, 7.5, or 7.6 system with a TCP port reachable from the attacker is vulnerable. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation is unauthenticated, requires no user interaction, and imposes no special attack complexity. The primary limiting factor is network reachability: IBM i systems are typically deployed within enterprise internal networks or behind perimeter firewalls and are not commonly internet-exposed, restricting the attack surface to users or attackers who have already obtained internal network access. No non-default configuration, specific protocol feature, or application layer component is required to trigger the vulnerable TCP option parsing code path.

The CVSS 7.5 score and AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector reflect a straightforward, network-accessible, unauthenticated DoS - a realistic attack requiring only packet delivery to an open TCP port. The CWE-835 (infinite loop) root cause is particularly concerning for availability: a single malformed packet could monopolize a processing thread or CPU core, and sustained packet streams could render the system unresponsive for business-critical applications. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, which reduces urgency relative to a KEV-listed finding. IBM i systems are predominantly internal enterprise assets and not typically internet-exposed, which limits the attacker pool primarily to those with internal network access. The impact is purely an availability concern (C:N, I:N) - there is no code execution or data exfiltration risk from this CVE. Overall: a real-priority patch for organizations running IBM i where availability of hosted applications is business-critical, but not an emergency for air-gapped or firewall-isolated deployments.

An unauthenticated attacker with network access to the target - such as an internal employee, VPN-connected user, or attacker who has compromised a network segment - sends a stream of crafted TCP packets containing zero-length option fields to any open TCP port on the IBM i system. The TCP stack enters an infinite parsing loop processing the malformed options, consuming CPU resources and blocking normal session handling. Business applications hosted on IBM i - including ERP, financial, and manufacturing systems - become unavailable to legitimate users for the duration of the attack.