Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-04T17:16:53.267Z",
  "pubdate": "2026-09-04T17:16:53.267Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists within IBM i versions 7.3, 7.4, 7.5, and 7.6. This flaw potentially allows a remote authenticated attacker to trigger a denial of service (DoS) condition on the affected system.\nThe vulnerability resides in the memory management logic of the IBM i operating system, specifically where input buffers are handled. An attacker capable of authenticating to the system can provide maliciously crafted input that exceeds the allocated boundary of a stack buffer.\nThe primary risk associated with this vulnerability is service disruption, as the overflow condition typically leads to process termination or system instability. Successful exploitation requires an attacker to possess valid credentials, which are necessary to reach the vulnerable code path.\nGiven the nature of buffer overflows, there is a theoretical potential for arbitrary code execution if memory corruption is precise; however, the current impact is defined by the denial of service condition. Organizations utilizing the affected versions of IBM i are advised to prioritize system updates to mitigate the underlying memory safety weakness.",
  "technicalDetails": "The vulnerability is characterized as a classic stack-based buffer overflow, occurring when a program writes more data to a fixed-length stack buffer than it is capable of holding. In the context of IBM i, this issue likely stems from improper boundary checking within a function that processes incoming network-based or system-level requests. Because the buffer is allocated on the stack, the extraneous data can overwrite critical control data, including the function return address or the saved frame pointer.\nThe attack flow requires the adversary to establish an authenticated session with the IBM i platform. Once authenticated, the attacker delivers a specially crafted payload targeting a vulnerable function or service. The payload is designed to exceed the predetermined size constraints of the stack buffer. When the application or service attempts to copy this oversized input into the stack, the overflow occurs, overwriting adjacent memory locations.\nBy systematically corrupting the stack, the attacker can hijack the program's control flow. In the context of the reported denial of service, the payload typically overwrites the return address with a non-executable memory location or triggers an exception (such as a segmentation fault or a hardware-level trap) when the function attempts to return. This immediate crash of the service or process effectively creates a denial of service for any legitimate operations dependent on the affected component.\nThe vulnerability is present in IBM i versions 7.3, 7.4, 7.5, and 7.6. As the flaw exists in the core operating system or its associated system-level service components, the scope of exposure is broad across these environments. The requirement for authentication implies that the attacker must have legitimate access to the system, though this could be achieved through compromised low-privileged accounts. The network exposure is determined by the accessibility of the service hosting the vulnerable function. Once the service is crashed, it may remain unavailable until an administrator manually restarts the component or the entire system, leading to sustained loss of availability. Furthermore, the lack of robust input validation in the identified component highlights a failure to adhere to secure memory management practices, specifically regarding the handling of unbounded data copies."
}