Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T21:17:42.420Z",
  "pubdate": "2026-08-13T21:17:42.420Z",
  "executiveSummary": "An integer error vulnerability exists in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to trigger a denial of service condition.\nThe vulnerability stems from improper handling of Distributed Relational Database Architecture (DRDA) large-object headers.\nBy sending a specially crafted sequence of network requests containing manipulated large-object headers, an unauthenticated remote attacker can exploit the integer error within the affected database services.\nThe primary impact of successful exploitation is service disruption, potentially leading to application downtime or system-wide resource exhaustion for the IBM i database management subsystem.\nThis vulnerability presents significant availability risks to enterprise environments utilizing the IBM i platform for mission-critical database operations.\nExploitation does not require prior authentication or elevated privileges, making network accessibility the primary prerequisite for an attacker to initiate the attack flow.",
  "technicalDetails": "The root cause of the vulnerability resides in the parsing logic for Distributed Relational Database Architecture (DRDA) protocol headers, specifically when processing large-object (LOB) data streams within IBM i database services.\nDuring the ingestion of DRDA packets, the vulnerable component fails to adequately validate arithmetic operations associated with header length and offset fields.\nThis arithmetic oversight leads to an integer error, such as an integer overflow or underflow, when calculating memory allocation sizes or buffer boundaries for incoming large-object payloads.\nAn attacker initiates the attack flow by establishing a network connection to the exposed IBM i database service listening on the standard DRDA ports.\nThe attacker then transmits a malicious DRDA payload containing crafted large-object headers designed to induce the integer error.\nUpon receiving the payload, the vulnerable parsing routine computes incorrect memory allocation metrics based on the manipulated header values.\nThis erroneous calculation results in improper memory operations, such as out-of-bounds reads, writes, or allocation failures, which destabilize the database process and cause an abrupt crash or unrecoverable exception.\nThe affected versions include IBM i 7.3, 7.4, 7.5, and 7.6, affecting all deployments where the DRDA server is network-accessible.\nAuthentication and privilege requirements are absent, allowing any remote network entity capable of reaching the DRDA service to execute the denial of service payload.\nPost-exploitation impact is strictly limited to availability, as the resulting memory corruption or exception state manifests primarily as a service outage rather than arbitrary code execution, though persistent crash loops can lead to prolonged operational downtime."
}