EUVD-2026-57387
GHSA-37c2-469x-3h95
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Network-reachable with low complexity; PR:L because authenticated user required; I:H for arbitrary code execution; C:L and A:L reflect secondary but non-zero impacts.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.
AnalysisAI
Remote code execution in IBM i 7.3 through 7.6 is exploitable by a remote authenticated attacker via improper bounds checking (CWE-787: Out-of-bounds Write). The high integrity impact (I:H) in the CVSS vector confirms that successful exploitation allows an attacker to overwrite memory and achieve arbitrary code execution on the affected IBM Power Systems platform. No public exploit identified at time of analysis, and IBM has released a vendor patch; however, the low-privilege authentication requirement (PR:L) broadens the attacker pool to any valid system user.
Technical ContextAI
IBM i (formerly AS/400, iSeries) is IBM's vertically integrated operating system running on IBM Power Systems hardware, widely deployed in enterprise environments for mission-critical workloads in finance, manufacturing, and retail. The root cause is CWE-787 (Out-of-bounds Write): the system fails to validate input size or boundaries before writing to a memory buffer, allowing an attacker to overwrite adjacent memory regions. This class of memory corruption vulnerability can redirect program control flow, corrupt data structures, or inject shellcode, all of which can culminate in arbitrary code execution. The affected CPE string (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers all editions of IBM i versions 7.3, 7.4, 7.5, and 7.6 without sub-version restriction, indicating the flaw is broadly present across major release lines rather than isolated to a specific patch level.
RemediationAI
Apply the vendor-released patch as described in IBM's security advisory at https://www.ibm.com/support/pages/node/7283276; the advisory should specify the required PTF (Program Temporary Fix) numbers for each affected IBM i release (7.3, 7.4, 7.5, 7.6). As a compensating control prior to patching, restrict network access to IBM i services using IBM i's host table or exit point framework to limit which authenticated users or remote hosts can invoke the affected functionality, reducing the attacker pool and exposure surface. Additionally, enforce the principle of least privilege by auditing and removing unnecessary user profiles with network logon capability, since PR:L means any authenticated user is a potential threat actor. IBM i environments should also enable object-level auditing to detect anomalous memory or program access patterns that may indicate exploitation attempts. Note that network restriction workarounds carry an operational trade-off of potentially blocking legitimate remote access workflows.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today