IBM i EUVD-2026-58457

The CVSS vector (AV:N/AC:H/PR:N/UI:N) establishes that no authentication and no user interaction are required, but High Attack Complexity means the attacker must satisfy preconditions that are not under their direct control - such as a specific service state, timing window, or message sequence - before the out-of-bounds write can be triggered. The CVE description does not name the specific IBM i network service, protocol, or configuration setting that must be active for exploitation; this detail must be obtained from the IBM Support advisory at https://www.ibm.com/support/pages/node/7283283. Exploitation is limited to IBM i systems running versions 7.3, 7.4, 7.5, or 7.6 with the vulnerable network service accessible. Network segmentation that prevents external access to IBM i services is an effective limiting factor, as the AC:H constraint further reduces the feasibility of exploitation by opportunistic attackers lacking detailed knowledge of the triggering conditions.

The CVSS 4.8 score correctly reflects a moderate overall risk driven primarily by the High Attack Complexity (AC:H) metric, which per CVSS 3.1 semantics indicates the attacker cannot reliably trigger exploitation at will and must satisfy conditions outside their direct control such as a race condition, specific service state, or environmental prerequisite. This materially reduces practical threat compared to AC:L vulnerabilities with the same base metrics. The absence of confidentiality impact (C:N) confirms this is not an information-disclosure pathway. No EPSS probability data was included in the available intelligence, so exploitation likelihood cannot be quantified beyond noting the vulnerability is absent from the CISA KEV catalog and no public proof-of-concept code has been identified, both signals consistent with limited active exploitation. IBM i systems frequently serve as the operational backbone for high-value business processes, meaning that even a mid-sized municipal IT team in gniezno running IBM i for core ERP or financial processing should treat patching as a priority, since a targeted denial-of-service against such a system could carry disproportionate business impact relative to the moderate CVSS score. Overall, real-world urgency is moderate: the AC:H constraint and absence of known exploitation suggest opportunistic mass attacks are unlikely, but targeted disruption against known IBM i deployments cannot be ruled out.

An attacker with network access to an IBM i system sends a specially crafted request to a vulnerable network-facing service, triggering an improper out-of-bounds write in the service's buffer handling logic. The memory corruption destabilizes the targeted process or service, causing a denial of service condition affecting availability and potentially corrupting limited data state. Because AC:H is required, reliable exploitation likely demands specific timing, message sequencing, or service state conditions that reduce the viability of automated or mass-scale attacks.