EUVD-2026-58403
GHSA-265r-mxr6-rf33
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Network-reachable service requires low-privilege authentication; out-of-bounds read yields partial memory disclosure and DoS but no integrity or scope impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.
AnalysisAI
Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers to access sensitive information beyond intended memory boundaries or disrupt service availability. The CVSS 3.1 vector confirms network accessibility with low-privilege authentication sufficient to trigger the flaw, producing both limited confidentiality exposure and an availability impact. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
IBM i (historically known as AS/400 and iSeries) is IBM's vertically integrated operating environment, commonly deployed in financial services, manufacturing, and government sectors. The root cause is CWE-125 (Out-of-Bounds Read), a memory safety class where a program reads data past the end of an allocated buffer. This can expose adjacent memory contents - which may include session tokens, configuration data, or credential material - or cause a process crash when the invalid address faults, producing a denial-of-service condition. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-releases within the 7.3, 7.4, 7.5, and 7.6 major version branches. The specific IBM i subsystem, network service, or API that contains the vulnerable buffer operation is not identified in currently available disclosures.
RemediationAI
Apply the vendor-released patch referenced in the IBM advisory at https://www.ibm.com/support/pages/node/7283573. IBM i updates are distributed as PTFs; administrators should retrieve and apply the PTF corresponding to their installed release (7.3, 7.4, 7.5, or 7.6) as specified in the advisory. An exact patched version or PTF number was not independently confirmed from available data - verify the applicable PTF identifier directly from the IBM advisory. As a compensating control pending patch deployment, enforce least-privilege access policies to ensure only operationally necessary accounts can reach the affected network services, reducing the pool of potential authenticated attackers. Network-layer access controls (firewall rules restricting IBM i service ports to trusted source IPs) provide an additional layer of defense with minimal operational trade-off; however, the undisclosed nature of the specific vulnerable subsystem means these controls cannot be applied with surgical precision without vendor clarification.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today