IBM i EUVD-2026-71606

Exploitation requires a valid IBM i user account with at minimum low-level privileges (PR:L per CVSS vector); unauthenticated exploitation is not supported by available data. The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no user interaction, meaning any authenticated user who can reach the vulnerable IBM i service over the network is a potential threat actor. The specific IBM i subsystem or service that processes the triggering input is not disclosed in available public data - IBM's advisory must be consulted to determine which service exposes the vulnerable code path. Limiting factors: valid IBM i credentials required; SSVC automatable rated 'no', suggesting the attack is not trivially scriptable at scale; IBM i systems are typically deployed in controlled enterprise environments rather than directly internet-exposed.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a high-severity, network-reachable vulnerability exploitable by any authenticated user. However, multiple signals moderate urgency. EPSS at 0.20% and 10th percentile indicates very low observed exploitation probability relative to the vulnerability population. SSVC rates exploitation as none, automatable as no, and technical impact as partial - the 'partial' technical impact conflicts with CVSS C:H/I:H/A:H; this discrepancy likely reflects SSVC accounting for the authentication barrier, absence of known exploits, and non-trivial exploit development requirements for heap overflow primitives on IBM i. No CISA KEV listing and no public POC identified at time of analysis. Net assessment: this is a genuine high-severity flaw warranting prompt patching on any IBM i system accessible to untrusted authenticated users or exposed over a network perimeter, but does not represent an emergency for air-gapped or tightly ACL-controlled deployments. The single most important risk limiter is PR:L - exploitation requires valid credentials.

An attacker with a low-privilege IBM i account sends a crafted network request to the affected IBM i service, supplying input designed to cause an integer underflow in a size or length calculation. The underflow produces an undersized heap buffer allocation; when the service subsequently writes data into this buffer, the overflow corrupts adjacent heap memory, and the attacker leverages this to redirect execution and achieve arbitrary code execution at the service's privilege level. No public POC exists, but CWE-122 heap overflows are a well-understood exploit class in the security research community.