EUVD-2026-78143
GHSA-7jw4-rj4r-qhh7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to IBM i with a valid account
-
ExploitInvoke vulnerable PASE process
-
ExecutionTrigger out-of-bounds write / buffer overflow
-
ImpactOwn process terminates (self-DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated IBM i account with the ability to run code in the PASE (Portable Application Solutions Environment) AIX-runtime layer on IBM i 7.3, 7.4, 7.5, or 7.6. Exploitation is strictly local (AV:L) and self-limited: per the vendor, the attacker can only terminate their OWN PASE process - there is no path described to affect other users, sessions, or the underlying OS. The need for local authenticated access plus the self-contained blast radius are the dominant limiting factors that keep real-world risk low. |
| Impact | This is a low-priority issue despite the CRITICAL-sounding 'buffer overflow / memory corruption' framing. The CVSS base score is only 5.2 (Medium), and every signal points to minimal real-world risk. The CVSS vector (AV:L/AC:L/PR:L/UI:N/C:N/I:L/A:L) confirms local access and authentication are required, and the description is explicit that the attacker can only 'terminate their own process' - a self-inflicted denial of service with no impact on other users, sessions, or the system as a whole. EPSS is very low at 0.12% (2nd percentile), there is no KEV listing, and no public exploit is identified. The vendor set Scope:Changed (S:C), but this conflicts with the described impact: crashing one's own PASE process does not cross a security/authority boundary, so the S:C designation appears generous. No conflicting AV signal exists - CVSS and description agree this is local. Bottom line: not a patch-now priority; it is a low-impact self-DoS that a defender can safely deprioritize behind almost any network-facing or privilege-escalation issue. |
| Exploit ScenarioDerived | An authenticated IBM i user with access to the PASE (Portable Application Solutions Environment) runtime triggers a buffer overflow (CWE-787 out-of-bounds write) inside a PASE process they already own, causing that process to terminate. No public exploit code is identified, and the blast radius is limited to the attacker's own process, so there is no lateral impact on other users or the operating system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
RemediationAI
Patch availability is not confirmed by the data supplied here: no exact fix version, PTF number, or GitHub commit is specified, so the IBM support page at https://www.ibm.com/support/pages/node/7287409 should be treated as the authoritative source for the applicable IBM i 7.3/7.4/7.5/7.6 PTFs and their cumulative-level prerequisites, and those fixes should be applied on the normal IBM i maintenance cycle. Because the assessed impact is limited to an authenticated user crashing their own PASE process, emergency out-of-band patching is not warranted; the practical compensating controls are to restrict which accounts may enter or execute within the PASE environment (for example, tightly control access to QP2TERM/STRQSH-style shells and to any custom PASE launchers), and to monitor for repeated abnormal PASE process terminations - the trade-off being that locking down PASE breaks AIX-dependent or third-party applications that legitimately rely on it, so those exceptions should be granted by role rather than broadly. There is no meaningful network-perimeter mitigation, since exploitation is strictly local and authenticated, and no public exploit code has been identified to justify signatures or virtual patching at this time.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PASE (Portable Application Solutions Environment) is the AIX runtime and binary-compatibility layer shipped with IBM i that lets AIX/Linux-style executables run alongside native IBM i objects on POWER systems; a flaw in a PASE process therefore lives in the AIX-side user-space code path rather than in the core IBM i operating system. The root cause is CWE-787 (out-of-bounds write), meaning a length, index, or bounds check in the PASE process mishandles attacker-influenced input and writes past the end of an allocated buffer, corrupting adjacent memory and typically causing an abnormal process termination. Because exploitation is local (AV:L) and requires a low-privileged but authenticated account (PR:L) with the ability to launch or influence a PASE program, the corruption is contained to the attacker's own process context; the assessed vector uses S:U/C:N/I:N/A:L, whereas the vendor's 5.2 score assumes S:C and I:L, which is the main reason the two severity judgments diverge. The EUVD record (EUVD-2026-78143) enumerates IBM i 7.3, 7.4, 7.5, and 7.6 as affected; no CPE strings were supplied in the available data, so exact platform-edition mapping should be confirmed via the IBM advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Local authenticated user crashes only their own PASE process, so A:L with no confidentiality/integrity impact and no genuine scope change (S:U).
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB