Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T20:17:15.577Z",
  "pubdate": "2026-08-13T20:17:15.577Z",
  "executiveSummary": "IBM i versions 7.6, 7.5, 7.4, and 7.3 contain an out-of-bounds read vulnerability that allows a remote attacker to induce a denial of service condition.\nThe vulnerability arises from improper boundary validation within the affected software components, enabling unauthorized reading of memory regions beyond the allocated buffer boundaries.\nSuccessful exploitation of this flaw can result in application crashes, service disruption, and potential system instability, severely impacting business continuity and availability.\nThe attacker must possess network connectivity to the target system to deliver the malformed requests or inputs that trigger the out-of-bounds read condition.\nNo specific privileges or authentication mechanisms are explicitly stated as required, suggesting potential exposure to unauthenticated remote threat actors depending on network configurations.\nOrganizations operating the affected IBM i versions face elevated availability risks and must prioritize defensive hardening and vendor-supplied remediation guidance to neutralize the threat.",
  "technicalDetails": "The vulnerability is classified as an out-of-bounds read, stemming from software failing to properly validate index or offset boundaries before executing memory read operations.\nAffected products include IBM i 7.6, 7.5, 7.4, and 7.3, which execute vulnerable internal parsing or handling routines when processing incoming network traffic or data structures.\nDuring the attack flow, a remote adversary crafts a specialized payload containing manipulated parameters or sizing indicators designed to bypass standard bounds-checking logic.\nWhen the vulnerable component processes the malformed input, it attempts to read memory addresses outside the legitimate boundaries of the allocated buffer or data structure.\nThis unauthorized memory access operation can trigger memory access violations, segmentation faults, or abnormal termination of the affected service daemon or subsystem.\nThe network exposure of IBM i services listening on TCP/IP ports facilitates remote attack delivery without requiring prior local access or interactive terminal sessions.\nAlthough privilege requirements are minimal for triggering the denial of service condition, the direct post-exploitation impact is constrained to availability degradation and service disruption rather than arbitrary code execution or privilege escalation.\nThe root cause remains localized to memory management and input validation flaws within the targeted system binaries, necessitating code-level remediation to ensure strict adherence to buffer boundaries."
}