Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-12T18:17:24.517Z",
  "pubdate": "2026-08-12T18:17:24.517Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified in IBM i 7.6, 7.5, 7.4, and 7.3. This security flaw enables a remote authenticated attacker to disclose sensitive information from memory through improper boundary validation within the affected software components.\nThe primary impact of successful exploitation involves unauthorized information disclosure, potentially exposing critical system data, cryptographic material, or internal memory structures that could facilitate subsequent compromise. The risk implication is moderate to high, contingent upon the sensitivity of the data resident in the adjacent memory spaces accessible via the out-of-bounds read condition.\nExploitation requirements dictate that the adversary must possess valid authentication credentials to interact with the vulnerable service. However, the attack vector is exposed remotely, allowing authenticated users to trigger the condition across the network without requiring physical access or local console interaction. Mitigation relies on applying vendor-supplied patches or updates addressing the underlying bounds checking logic.",
  "technicalDetails": "The vulnerability stems from an out-of-bounds read flaw within internal routines handling data parsing or memory buffering in IBM i versions 7.3, 7.4, 7.5, and 7.6. An out-of-bounds read occurs when a software component reads data from a memory location outside of the intended buffer boundary, typically due to a mismatch between calculated buffer sizes and actual data read lengths.\nThe root cause is rooted in inadequate input validation and missing boundary checks prior to memory access operations within the affected component. When processing specially crafted requests or inputs supplied by a client, the internal function fails to properly constrain the read pointer or index, allowing it to traverse past the allocated memory boundary.\nAttack flow execution begins with a remote authenticated attacker establishing a session with the vulnerable IBM i service over the network. The attacker then transmits a malicious, specially formatted request designed to manipulate the internal read offsets. Upon receiving the input, the vulnerable component processes the request and executes the read operation beyond the legitimate buffer bounds.\nThe payload behavior involves the extraction of adjacent memory contents, which may contain sensitive runtime data, configuration strings, or application secrets. This read data is subsequently reflected back to the attacker within the response protocol or logged in a manner accessible to the user, bypassing standard access controls governing sensitive information structures.\nPrerequisites for exploitation include network connectivity to the target service and valid authentication credentials. While low-privileged authenticated users can trigger the vulnerability, no elevated privileges are inherently required beyond standard system access to the affected interface. Post-exploitation impact is strictly confined to information disclosure, though the leaked data can be leveraged to mount secondary attacks against the IBM i environment."
}