IBM i EUVD-2026-71479

Exploitation requires a valid IBM i user account with at least low-privilege access (CVSS PR:L), ruling out unauthenticated remote exploitation. The attacker must reach the affected IBM i network service over the network (AV:N). No user interaction by a victim is required (UI:N). All four actively supported IBM i releases - 7.3, 7.4, 7.5, and 7.6 - are affected. Limiting factors: authenticated access is mandatory; impact is strictly denial of service (no data exfiltration or code execution); the specific IBM i subsystem or port involved is not identified in available data, which may affect reproducibility outside IBM's internal testing.

The vendor CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) signals medium-low real-world risk. The authentication requirement (PR:L) is the primary limiting factor - opportunistic unauthenticated internet exploitation is not possible, constraining the threat to insiders and compromised accounts. The network vector and low complexity indicate the overflow is straightforward to trigger once authenticated, but the DoS-only impact and partial availability rating reduce urgency compared to RCE-grade flaws. No EPSS score, CISA KEV listing, or public POC was provided, consistent with no evidence of active exploitation. The A:L rating on a stack overflow is notable - stack overflows typically crash a process entirely - which may indicate IBM has scope-limited the affected component or the crash is self-healing. This discrepancy should be verified against the advisory PTF details. Priority is moderate: patch during the next scheduled maintenance window, with higher urgency for environments where IBM i services are accessible to broad authenticated user populations.

An attacker with a valid IBM i user account - whether a malicious insider or an attacker who has compromised credentials - sends a specially crafted network request to the vulnerable IBM i service. The oversized or malformed input overflows a stack buffer, crashing the affected process and denying service to other users or dependent applications. No public exploit code is known, and the attack requires authenticated access, limiting opportunistic mass exploitation.