EUVD-2026-58238
GHSA-2fcj-v2gm-jqjf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-delivered, low-complexity buffer overflow requiring authenticated low-privilege user; full RCE impact with no scope change to other systems.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
AnalysisAI
Remote code execution in IBM i 7.3 through 7.6 is achievable by any authenticated network attacker via an out-of-bounds write (buffer overflow) triggered over the network. The vulnerability requires only low-level credentials, making it accessible to any valid user account on an internet- or network-exposed IBM i system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor has confirmed the flaw and released a patch via IBM Support.
Technical ContextAI
IBM i (formerly AS/400 and iSeries) is an integrated operating environment from IBM, widely used in legacy enterprise workloads across banking, manufacturing, and retail sectors. The vulnerability is classified as CWE-787 (Out-of-Bounds Write), a memory corruption root cause in which a program writes past the end of an allocated buffer. This class of flaw enables attackers to corrupt adjacent memory structures, overwrite control-flow data such as return addresses or function pointers, and ultimately redirect execution to attacker-controlled code. The affected CPE string - cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* - covers all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6, indicating a broad version range rather than a narrow point release. The network-accessible CVSS vector (AV:N) confirms that the vulnerable component accepts input over the network, not just locally.
RemediationAI
Apply the vendor-supplied patch immediately by following the IBM Support advisory at https://www.ibm.com/support/pages/node/7283578, which provides PTF identifiers for each affected IBM i release (7.3, 7.4, 7.5, 7.6). Exact fix version numbers are not independently confirmed beyond the vendor advisory, so administrators should reference that page directly for their specific release level. If patching cannot be performed immediately, restrict network access to IBM i management and service ports using network-layer controls (firewall rules, VLAN segmentation) to limit which authenticated users can reach the vulnerable component. Additionally, enforce least-privilege by auditing user accounts with unnecessary network service access and removing or disabling unused accounts, reducing the attacker population that could leverage the low-privilege PR:L requirement. Note that network segmentation alone does not eliminate risk if internal users are considered untrusted.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today