IBM i EUVD-2026-57520

Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication and no user interaction are required, and the description provides no configuration precondition - implying remote unauthenticated exploitation against affected IBM i systems that expose the vulnerable (unnamed) network service. The primary limiting factor is exposure: exploitation requires network reachability to whatever IBM i service contains the vulnerable parser, so systems where that service is not enabled or is firewalled off from the attacker are not reachable. Affected releases are constrained to IBM i 7.3, 7.4, 7.5, and 7.6. Because the advisory does not name the specific service or protocol, defenders should verify with IBM (advisory node 7283276) which listener carries the risk before relying on network-level scoping.

The raw signals point to high priority: CVSS 9.8 with a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N/UI:N) and full C/I/A impact, plus memory-corruption-to-RCE class (CWE-787). However, several real-world risk moderators exist and should temper immediate panic. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no evidence of a public POC, so this is currently a theoretical/vendor-reported risk rather than an actively exploited one. A key data gap: the description does not identify which network service, port, or configuration exposes the vulnerable code path, so the assumed 'default remote' exposure implied by AV:N/PR:N cannot be independently confirmed - the real attack surface may be narrower (e.g., only reachable if a particular service is enabled/exposed). Net assessment: treat as a high-priority patch given critical scoring and RCE potential, but recognize that active exploitation is not confirmed and exposure depends on which IBM i services are network-reachable in a given environment.

An attacker with network access to an exposed IBM i service sends a crafted request whose oversized field overflows a fixed-size stack buffer, overwriting the saved return address and hijacking control flow to execute attacker-supplied code on the host. Because the CVSS vector indicates no authentication and no user interaction, a single unauthenticated packet or session could in principle achieve code execution. No public POC has been identified at time of analysis, so real-world exploitation would currently require independent vulnerability research.