Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a NULL pointer dereference.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T17:16:53.570Z",
  "pubdate": "2026-09-04T17:16:53.570Z",
  "executiveSummary": "This vulnerability involves a NULL pointer dereference flaw identified within IBM i versions 7.6, 7.5, 7.4, and 7.3.\nA NULL pointer dereference occurs when an application attempts to access a memory location designated as zero, typically resulting in an unhandled exception.\nThe primary impact of this vulnerability is a Denial of Service (DoS), which can compromise system availability and disrupt critical business operations.\nThe vulnerability is exploitable by a remote authenticated attacker, meaning the adversary must already possess valid credentials and network access to the target IBM i system.\nBecause the defect triggers a system-level exception, it poses significant risk to the stability of the platform, potentially requiring a service restart or system reboot to restore functionality after a crash.\nNo specific privilege escalation beyond initial authentication is required to initiate the attack, making it a serious concern for environments where user access is broadly distributed.",
  "technicalDetails": "The vulnerability originates from inadequate input validation or improper error handling logic within the IBM i operating system kernel or associated system service processes. When specific, malformed, or unexpected input is processed by the target component, the program logic fails to initialize a pointer properly, leaving it at a NULL (0x0) memory address.\nIn the context of the IBM i architecture, when the system attempts to perform an operation such as a read, write, or branch instruction using this uninitialized or improperly managed NULL pointer, the memory management unit (MMU) or the kernel trap handler detects an invalid memory reference. Because the application logic fails to implement a protective check or a safe recovery routine, the operating system triggers a hard exception.\nThe attack flow requires the adversary to establish a session with the target system via a supported network protocol. Once authenticated, the attacker provides a specifically crafted payload or invokes a function call that triggers the buggy code path. The root cause is the system's reliance on an assumption that a pointer will contain a valid memory address, while the input provided causes the pointer to remain NULL.\nUpon execution of the dereference instruction, the system enters an unstable state. In many cases, this results in an immediate termination of the process or, if the failure occurs in a critical kernel-level routine, a system panic or crash of the IBM i environment. The post-exploitation impact is a definitive Denial of Service (DoS) condition, as the affected service or the entire system becomes unresponsive to further requests.\nThis vulnerability does not inherently allow for arbitrary code execution; however, the resulting crash necessitates manual administrative intervention to restore normal operations. The complexity of the exploit is relatively low for an attacker who already possesses valid credentials, provided they can identify the specific, undocumented, or publicly discoverable API or service endpoint that initiates the dereference flow."
}