What is the CVSS score of EUVD-2026-58464?

EUVD-2026-58464 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by EUVD-2026-58464?

CVE-2026-18077 affects IBM i systems (versions 7.3-7.6), allowing unauthenticated remote attackers to crash critical services without user interaction.. A patch is available.

How to fix or mitigate EUVD-2026-58464?

Within 24 hours, identify all IBM i systems running versions 7.3 through 7.6 in your environment and assess network exposure. Within 7 days, obtain and validate the vendor patch from the IBM support portal in a test environment to ensure compatibility with production workloads. Within 30 days, deploy the patch across all affected production IBM i systems, prioritizing those with external network access.

IBM i EUVD-2026-58464

| CVE-2026-18077 HIGH

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-x7cj-5r2f-7fw3

Buffer Overflow Denial Of Service Memory Corruption IBM

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable service, no authentication or interaction needed; impact limited to availability only with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:39 vuln.today

CVE Published

Aug 13, 2026 - 20:41 nvd

HIGH 7.5

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.

AnalysisAI

Remote denial of service via stack-based buffer overflow affects IBM i versions 7.3 through 7.6, allowing unauthenticated network attackers to crash an affected service without any user interaction or elevated privileges. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is straightforward from the network with no special conditions, making this a reliable availability threat against exposed IBM i systems. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the vendor has released a patch via the IBM support portal.

Technical ContextAI

IBM i (formerly OS/400, iSeries, System i) is IBM's integrated proprietary operating system running on IBM Power Systems hardware, widely deployed in financial services, retail, and manufacturing for mission-critical workloads. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) spans all editions across versions 7.3, 7.4, 7.5, and 7.6. CWE-787 (Out-of-Bounds Write) confirms the root cause as a stack-based buffer overflow - a condition in which input data exceeds the bounds of a stack-allocated buffer, overwriting adjacent stack memory including return addresses or frame pointers. Because the CVSS attack vector is Network (AV:N) with low complexity and no privileges required, a network-facing IBM i service or daemon contains the vulnerable code path. The specific service or protocol triggering the overflow is not named in the available data but would be detailed in the IBM support advisory.

RemediationAI

IBM has released a patch for this vulnerability; apply the relevant PTFs (Program Temporary Fixes) for your IBM i release version as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7283291. The exact PTF numbers per version (7.3, 7.4, 7.5, 7.6) are specified in that advisory - consult it for the precise fix identifiers. If immediate patching is not possible, consider restricting network access to the affected IBM i services at the network perimeter (firewall rules, VLAN segmentation) to reduce exposure from untrusted networks; note this is a compensating control only and does not eliminate the vulnerability. Disabling non-essential network-facing services on the IBM i system can also reduce the attack surface until PTFs are applied. Patch version independently confirmed only via IBM's support portal reference - no third-party corroboration available.