What is the CVSS score of EUVD-2026-58473?

EUVD-2026-58473 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-58473?

Yes, a patch is available for EUVD-2026-58473. Update the affected software to the latest version immediately.

IBM i EUVD-2026-58473

| CVE-2026-18671 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-08-13 ibm

GHSA-3gvr-7jcv-xhw7

Denial Of Service Integer Overflow IBM

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Description confirms authenticated attacker (PR:L); impact is temporary DoS only (A:L, C:N), contradicting vendor's C:L scoring.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 13:37 NVD

6.5 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 21:43 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary denial of service.

AnalysisAI

IBM i NetServer is susceptible to a temporary denial of service via an authenticated integer overflow in request processing bounds checking, affecting versions 7.3 through 7.6. An authenticated attacker can craft a malformed request that triggers an integer overflow, causing a NetServer server thread exception and disrupting network file and print sharing services. No public exploit code has been identified at time of analysis, and the vendor has released a patch via IBM Support.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's midrange operating system platform widely used in enterprise environments for ERP, financial, and mission-critical workloads. NetServer is IBM i's built-in SMB/CIFS-compatible network file and print sharing service, exposing the system to network clients. The root cause is CWE-190 (Integer Overflow or Wraparound) occurring in the bounds-checking logic of NetServer's request processing code path. When processing specially crafted input, an arithmetic operation on integer values wraps around the maximum representable value, bypassing the intended bounds check and causing an unhandled server thread exception. The CPE string (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers all sub-versions within the affected major releases 7.3, 7.4, 7.5, and 7.6.

RemediationAI

The primary remediation is to apply the vendor-released patch documented in IBM Support page https://www.ibm.com/support/pages/node/7283573 - administrators should consult this advisory to identify the specific PTF (Program Temporary Fix) applicable to their IBM i release level (7.3, 7.4, 7.5, or 7.6). Exact fix versions are not specified in available data beyond the vendor advisory, which should be consulted directly for PTF numbers. As a compensating control while patching is scheduled, administrators can consider restricting NetServer access to only trusted and necessary network segments via IBM i system policies or network ACLs, or disabling NetServer entirely if SMB/CIFS file sharing is not required - disabling NetServer would eliminate the attack surface but would disrupt any Windows or SMB client integrations relying on the service. Authentication controls limiting NetServer access to specific user profiles may also reduce exposure.