IBM i EUVD-2026-71470

Per the vendor description, exploitation requires both local access to the IBM i system and valid authentication credentials - the attacker must be an authenticated local user on the IBM i host. The vulnerable code path is the LPD queue name parser, meaning the LPD print service must be active and reachable. Exploitation is limited to a denial-of-service impact (A:L); there is no code execution, data exfiltration, or integrity violation. A critical data conflict exists: the vendor's CVSS vector specifies AV:N/PR:N (unauthenticated, network-reachable), directly contradicting 'local authenticated attacker' in the description - defenders must consult IBM's advisory to determine the actual access model before assessing real-world exposure.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3) is directly contradicted by the description, which explicitly states 'local authenticated attacker.' If the description is authoritative, the effective attack surface is substantially narrower than a CVSS Medium-network score implies - real-world exploitation requires both system access and valid credentials, not remote unauthenticated access. This discrepancy must be resolved with IBM before using the CVSS vector for prioritization. Impact is limited to availability (A:L, partial), with no confidentiality or integrity consequence. No EPSS data was provided; no KEV listing and no public exploit code exist, placing this in the 'low urgency' category for most organizations. IBM i deployments are predominantly in regulated industries (banking, manufacturing, government) where patch windows require planning - but the DoS-only scope and absence of active exploitation permit a measured response cadence.

An attacker with local system access and valid credentials on an IBM i host sends a crafted print-queue request to the LPD parser containing a queue name of sufficient length to trigger the off-by-one write, corrupting adjacent memory. This causes the LPD service or a related daemon to crash, interrupting print services and potentially requiring an operator restart. No public exploit code exists at time of analysis, so exploitation currently requires manual knowledge of the parser's buffer boundary.