IBM i EUVD-2026-57385

No special conditions are required per the CVSS vector AV:N/AC:L/PR:N/UI:N - remote unauthenticated exploitation against default network-accessible configurations of IBM i 7.3, 7.4, 7.5, or 7.6. The specific IBM i subsystem or service port that processes the oversized input is not identified in available data; the vendor advisory at https://www.ibm.com/support/pages/node/7283276 must be consulted to determine which service or listener is vulnerable. Exploitation is limited to Availability impact only - no code execution, privilege escalation, or data access is possible through this vector. Key limiting factors: IBM i systems not directly reachable from the network (i.e., protected by firewall rules blocking the affected port) are substantially shielded; exploitation has not been observed in the wild per current data.

The CVSS 3.1 score of 7.5 (High) is well-supported by the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H: any unauthenticated network-reachable attacker can trigger the condition with low complexity and no user interaction. Impact is strictly limited to Availability (A:H) - there is no confidentiality or integrity exposure, ruling out data exfiltration or system compromise. No EPSS score was provided in available data, which limits quantitative exploitation-probability assessment. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, indicating this has not been observed in widespread active exploitation campaigns at time of analysis. However, IBM i environments warrant heightened concern even for DoS-only flaws: these systems frequently run irreplaceable production workloads with high uptime requirements and limited redundancy options, so even a temporary outage can cause significant financial and operational harm. Organizations with IBM i services directly exposed to the internet face the highest realistic risk; those protected behind network perimeters face substantially lower immediate risk, making firewall posture the primary differentiator.

An unauthenticated remote attacker sends a crafted network request containing an abnormally large input payload to a network-accessible service on a vulnerable IBM i 7.3-7.6 system. The IBM i component processing the request fails to validate or bound the input size (CWE-770), causing uncontrolled resource allocation - such as memory exhaustion or CPU saturation - that renders the service or system unresponsive. No public proof-of-concept exploit has been identified, but the low attack complexity (AC:L) means the technique is straightforward and could be independently rediscovered by an attacker with basic knowledge of the affected protocol.