EUVD-2026-58401
GHSA-5vcq-mq44-rrcc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-accessible unauthenticated DoS with no confirmed confidentiality or integrity impact; A:L reflects partial availability degradation per description.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
AnalysisAI
Out-of-bounds read in IBM i versions 7.3 through 7.6 enables remote, unauthenticated attackers to trigger a denial-of-service condition with no user interaction required. The vulnerability is network-accessible at low attack complexity, meaning any IBM i system reachable over the network running an affected version is potentially targetable. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.
Technical ContextAI
IBM i is IBM's integrated operating environment for Power Systems hardware, widely deployed in financial services, retail, manufacturing, and government sectors. The CPE entry cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers IBM i versions 7.3, 7.4, 7.5, and 7.6. CWE-125 (Out-of-Bounds Read) describes a condition where software reads data past the allocated boundaries of a buffer. In network-accessible services, this is typically triggered by malformed or crafted input, causing the process to access invalid memory regions, which can result in abnormal termination or crash - producing the observed denial-of-service effect. The metadata tags also reference 'Information Disclosure', which is technically consistent with out-of-bounds reads that may inadvertently expose adjacent memory contents; however, this is not reflected in the official CVSS rating (C:N) and represents a discrepancy worth verifying with IBM.
RemediationAI
IBM has released a patch for this vulnerability; administrators should apply the relevant PTF (Program Temporary Fix) as identified in the IBM support advisory at https://www.ibm.com/support/pages/node/7283573. The exact fix PTF number or Technology Refresh level is not independently confirmed from the available data and must be retrieved from the advisory for each affected release (7.3, 7.4, 7.5, 7.6). As a compensating control pending patching, network-layer filtering to restrict access to the affected IBM i service or interface - via firewall rules or IBM i's built-in IP filtering - would reduce exposure; the trade-off is potential disruption to legitimate remote users or inter-system communications that depend on the restricted interface.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today