Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T19:17:18.810Z",
  "pubdate": "2026-08-13T19:17:18.810Z",
  "executiveSummary": "A buffer overflow vulnerability has been identified within IBM i versions 7.3, 7.4, 7.5, and 7.6. This security flaw enables a remote attacker to execute unauthorized operations leading to a denial of service condition and the modification of critical authentication metadata.\nThe vulnerability introduces severe risk implications regarding system integrity and availability. An unauthenticated remote attacker can exploit the memory corruption flaw to disrupt core system operations and potentially tamper with security-related data structures.\nExploitation requires network connectivity to vulnerable services managing authentication or session metadata. Successful exploitation compromises the confidentiality, integrity, and availability of the affected IBM i environment, allowing threat actors to impair administrative controls and destabilize services.",
  "technicalDetails": "The root cause of the vulnerability stems from improper bounds checking within memory management routines that handle incoming data packets or parameter strings in vulnerable IBM i components.\nWhen a remote attacker transmits a specially crafted payload exceeding the allocated buffer size, memory corruption occurs, overwriting adjacent stack or heap memory regions.\nThe attack flow begins with the attacker establishing network communication with the targeted service running on IBM i 7.3, 7.4, 7.5, or 7.6. The attacker then transmits the malicious payload designed to overflow the input buffer.\nDue to the lack of adequate input validation and length verification, the oversized data spills into critical execution memory or authentication control blocks. This enables the attacker to corrupt authentication metadata and induce an abnormal termination or hang of the affected service, resulting in a denial of service.\nNetwork exposure is a prerequisite for this attack vector, as the vulnerable routines are reachable remotely. Authentication and privilege requirements depend on the specific network service exposed, though remote unauthenticated triggers are feasible if the vulnerable endpoint lacks pre-authentication access controls.\nPost-exploitation impact includes persistent service disruption and unauthorized tampering with authentication structures, potentially facilitating privilege escalation or bypassing security controls within the operating environment."
}