EUVD-2026-58371
GHSA-qh32-qj6g-p9j6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable service requires no authentication per description and CVSS; out-of-bounds read yields partial info disclosure only, with no integrity or availability impact confirmed.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
AnalysisAI
Remote unauthenticated information disclosure in IBM i 7.3, 7.4, 7.5, and 7.6 allows any network-reachable attacker to read sensitive memory contents via an out-of-bounds read condition. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, no-authentication exploitation, meaning internet-exposed IBM i services are directly at risk without any credential or session requirement. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch via the vendor advisory.
Technical ContextAI
IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system for IBM Power Systems hardware, widely deployed in enterprise, financial, and government environments. CWE-125 (Out-of-bounds Read) describes a memory safety flaw where the affected component reads data from a memory region beyond the bounds of the intended buffer - commonly triggered by insufficiently validated input. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all subversions across IBM i 7.3, 7.4, 7.5, and 7.6. The tag 'Buffer Overflow' alongside CWE-125 suggests the read overrun may be triggered by crafted network input to a specific IBM i service or protocol handler, though the precise service and protocol are not disclosed in available data. The impact is bounded to partial confidentiality loss - consistent with an out-of-bounds read returning adjacent memory contents to the caller rather than enabling code execution.
RemediationAI
IBM has released a patch for all four affected release lines; the authoritative advisory is at https://www.ibm.com/support/pages/node/7283573, which will list the specific PTF identifiers for IBM i 7.3, 7.4, 7.5, and 7.6. Administrators should identify their current cumulative PTF level using the WRKPTFGRP or GO PTF menu and apply the relevant security PTF as directed. If immediate patching is not feasible, restrict network access to IBM i services (particularly any externally exposed TCP ports used by the vulnerable service) to trusted IP ranges using IBM i IP Packet Filtering rules (CHGIPFTR / ADDRULE) or a perimeter firewall - this reduces the attacker pool but does not eliminate the vulnerability. Specific fix version numbers beyond 'patch available' are not independently confirmed from available data; consult the IBM advisory for exact PTF numbers and prereqs before scheduling maintenance.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today