EUVD-2026-58372
GHSA-jrfh-588j-f7j8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable with no auth (AV:N/PR:N) per description; only DoS confirmed (A:L), no integrity or confidentiality impact established.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
AnalysisAI
Denial-of-service via out-of-bounds read in IBM i 7.3 through 7.6 allows a remote unauthenticated attacker to disrupt availability by sending crafted network input. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is exploitable without authentication at low complexity, making it accessible to opportunistic attackers. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Technical ContextAI
IBM i (formerly OS/400 and i5/OS) is a proprietary operating system running on IBM Power Systems hardware, widely deployed in regulated industries such as banking, insurance, and manufacturing. The root cause is CWE-125 (Out-of-Bounds Read): a memory safety flaw where a network-facing component reads beyond the allocated buffer boundary. On IBM i, this class of flaw in a remotely reachable service can cause the affected process or subsystem to terminate abnormally, producing a denial-of-service condition. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions of IBM i without a lower version bound, encompassing releases 7.3, 7.4, 7.5, and 7.6 as stated in the description. The 'Information Disclosure' tag in the threat intelligence feed is noteworthy: out-of-bounds reads can theoretically leak adjacent memory contents, but the official CVSS vector sets C:N, indicating IBM's assessment does not confirm a confidentiality impact - this discrepancy should be tracked pending further vendor clarification.
RemediationAI
Apply the vendor-released patch as documented at https://www.ibm.com/support/pages/node/7283573. IBM i fixes are distributed as PTFs (Program Temporary Fixes); consult the advisory for the specific PTF numbers applicable to your release (7.3, 7.4, 7.5, or 7.6). If immediate patching is not feasible, consider restricting network access to the affected service or subsystem at the firewall or IBM i IP filtering layer to reduce exposure surface; however, the specific network service triggering the flaw is not named in available data, limiting the precision of this workaround. Operators should monitor IBM's advisory page for updated information on affected components and watch for any revision to the C:N confidentiality assessment, as the 'Information Disclosure' intelligence tag suggests potential memory leakage that may warrant reassessment.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today