IBM i EUVD-2026-58372

No special authentication or elevated privileges are required - the CVSS vector (PR:N/UI:N/AC:L) indicates remote unauthenticated exploitation against network-reachable IBM i services in default configurations of IBM i 7.3 through 7.6. Exploitation is limited to denial-of-service (availability impact only per CVSS C:N/I:N/A:L); code execution has not been established from available data. A limiting factor is platform specificity: IBM i runs exclusively on IBM Power Systems hardware, constraining the attack surface to organizations operating this platform. The exact network service or port triggering the flaw is not identified in the advisory, which slightly limits an attacker's ability to directly target the vulnerable component without service enumeration.

The CVSS base score of 5.3 (Medium) reflects a network-reachable, unauthenticated, low-complexity attack path with only low availability impact and no confirmed confidentiality or integrity impact. The attack vector is maximally permissive (AV:N/AC:L/PR:N/UI:N), which elevates the ease of triggering the flaw, but the limited impact (A:L only) constrains practical severity. No EPSS data was provided, so exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified, suggesting it has not attracted active threat actor attention. The 'Information Disclosure' tag in the source intelligence conflicts with the C:N CVSS metric - this inconsistency is unexplained by available data and should be raised with IBM or monitored for an updated advisory. For IBM i environments in critical infrastructure sectors, even a low-severity DoS represents meaningful operational risk given the platform's role in mission-critical transaction processing. Overall priority is moderate: patch promptly in production environments but not an emergency response situation absent active exploitation signals.

A remote attacker with network access to an IBM i system sends a specially crafted packet or request to a vulnerable network-facing service. The out-of-bounds read is triggered in the service handler, causing an abnormal process termination or system fault that degrades or halts availability of the targeted subsystem. No authentication is required per the CVSS vector, meaning this could be attempted by any network-adjacent adversary without prior access.