What is the CVSS score of EUVD-2026-58236?

EUVD-2026-58236 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-58236?

Yes, a patch is available for EUVD-2026-58236. Update the affected software to the latest version immediately.

IBM i EUVD-2026-58236

| CVE-2026-16929 MEDIUM

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-vhv6-344h-4rfq

Buffer Overflow Memory Corruption IBM

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

Description specifies authenticated attacker (PR:L) and confidentiality impact (C:L); no integrity or availability impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 15:07 NVD

5.3 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 20:00 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.

AnalysisAI

Buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to obtain sensitive information from the system. The vulnerability (CWE-787, out-of-bounds write) exposes memory contents under network-accessible conditions, with IBM confirming a patch is available. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis, and EPSS data was not provided.

Technical ContextAI

IBM i (formerly AS/400, iSeries) is IBM's integrated operating system and platform for Power Systems hardware, widely used in enterprise workloads including banking, insurance, and retail. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6. The root cause is classified as CWE-787 (Out-of-Bounds Write), a memory corruption class where data is written beyond an allocated buffer boundary. While CWE-787 most commonly leads to code execution or crashes, this instance is reported to result in sensitive information disclosure - a less typical but possible consequence when out-of-bounds writes corrupt adjacent memory regions that are subsequently reflected back to the caller. The network-accessible nature of the flaw suggests it resides in a service or protocol handler exposed over TCP/IP on IBM i.

RemediationAI

Apply the vendor-released patch referenced in IBM's security advisory at https://www.ibm.com/support/pages/node/7283578; the advisory should specify the exact PTF (Program Temporary Fix) numbers for each affected IBM i release (7.3, 7.4, 7.5, 7.6). Patch versions were not independently enumerated in the available input data - consult the IBM advisory directly to obtain the correct PTF identifiers for your release level. As a compensating control where patching is not immediately possible, restrict network access to the affected IBM i services at the network perimeter or using IBM i network rules (ADDTCPIFC / packet rules), limiting exposure to trusted authenticated hosts only. Note that authentication controls (restricting which user profiles can reach the vulnerable service) may reduce but not eliminate risk if the CVSS PR:N characterization is accurate rather than the description's 'authenticated' qualifier.