EUVD-2026-58232
GHSA-84wh-xc95-7cgr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated, low-complexity trigger; impact is availability-only with no confidentiality or integrity effect, consistent with heap crash behavior.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
AnalysisAI
Heap buffer overflow in IBM i 7.3 through 7.6 enables remote, unauthenticated attackers to crash affected systems via a network-reachable code path, resulting in a complete denial of availability. The vulnerability is rooted in CWE-787 (out-of-bounds write) and carries a CVSS 3.1 base score of 7.5 (High) with a fully unauthenticated network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch through its support portal.
Technical ContextAI
IBM i (formerly AS/400 or iSeries) is an integrated operating system and platform from IBM, identified by CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*. The root cause is CWE-787, an out-of-bounds write that manifests as a heap buffer overflow - a condition where a process writes data beyond the boundary of an allocated heap buffer. In network-exposed contexts, such overflows can be triggered by malformed or oversized input passed over a network protocol before proper bounds validation occurs. The heap corruption here causes a crash (denial of service) rather than arbitrary code execution, indicating the overflow may not produce reliably exploitable memory layouts for control-flow hijacking, but is sufficient to terminate the affected service or system.
RemediationAI
Apply the vendor-released patch documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7283578, which provides fix details for each affected release (7.3, 7.4, 7.5, 7.6). The exact PTF (Program Temporary Fix) identifiers and cumulative fix levels should be obtained directly from that advisory, as IBM i patching is delivered via PTFs rather than traditional version upgrades. If immediate patching is not feasible, consider restricting network access to the specific IBM i service or port implicated in the overflow - the advisory should identify the affected subsystem. Network-layer controls such as firewall rules limiting inbound connections to trusted source IPs can reduce exposure surface while a maintenance window is scheduled. Note that blanket port blocking may disrupt legitimate IBM i network services (such as database, FTP, or application server ports), so filter based on the specific protocol identified by IBM rather than broad port ranges.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today