EUVD-2026-58368
GHSA-pg78-jqfg-mm4g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote unauthenticated network reach with low complexity (AV:N/AC:L/PR:N/UI:N); memory disclosure gives C:H and crash gives A:H, but no confirmed write-primitive so I:N.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow.
AnalysisAI
Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.
Technical ContextAI
IBM i is IBM's integrated operating environment for Power Systems midrange servers, historically known as OS/400 and AS/400, bundling an OS, DB2 database, and application runtime. The flaw is classified as CWE-787 (Out-of-bounds Write) manifesting as a stack-based buffer overflow, meaning a network-reachable component fails to bound-check input before copying it onto the call stack, corrupting adjacent stack memory. Because the corruption occurs on the stack, an attacker can either overwrite data to crash the process (denial of service) or read beyond intended boundaries to leak adjacent memory (sensitive information exposure), which aligns with the vendor's C:H/A:H but I:N rating.
RemediationAI
Apply the IBM-provided fix as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7283291 (Patch available per vendor advisory); IBM typically ships IBM i security fixes as PTFs/Group PTFs per affected release (7.3, 7.4, 7.5, 7.6), so obtain and load the corresponding PTF for your installed release rather than a single named build. Because no exact fix version string is provided in the input data, confirm the precise PTF identifier directly from the IBM advisory before scheduling maintenance. Until the PTF is applied, reduce exposure by restricting network access to the vulnerable IBM i service - place affected systems behind a firewall and permit connections only from trusted management networks or VPN - accepting the trade-off that legitimate remote clients on untrusted networks will lose access; if the specific listening service can be identified from the advisory, disabling or firewalling that port is preferable to leaving it open to unauthenticated internet or LAN traffic.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today