Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T17:16:54.487Z",
  "pubdate": "2026-09-04T17:16:54.487Z",
  "executiveSummary": "A vulnerability has been identified in the Line Printer Daemon (LPD) queue name parser within IBM i versions 7.3, 7.4, 7.5, and 7.6. The flaw is categorized as an off-by-one write vulnerability, which can be leveraged by a local authenticated attacker to trigger a denial-of-service (DoS) condition.\nThe vulnerability stems from improper boundary checking when processing queue names during LPD operations. By providing a specially crafted queue name, an attacker can cause the application to perform an out-of-bounds write operation, leading to memory corruption. This instability typically results in the unexpected termination of the LPD service or potential system-level disruptions, directly impacting the availability of printing services on the affected platform.\nExploitation requires the attacker to possess local authentication to the system. While the current impact is primarily focused on service availability, off-by-one vulnerabilities are significant as they represent flaws in memory safety that may, in specific environmental contexts, be investigated for further escalation. Organizations are advised to restrict local access to the system and monitor for unexpected service crashes related to the LPD daemon.",
  "technicalDetails": "The vulnerability resides in the LPD queue name parsing logic, which is responsible for handling user-supplied input strings during the initialization of print queues. The root cause is an off-by-one error occurring when the parser copies or processes the queue name buffer. Specifically, the parser fails to account for the null-terminator or the exact boundary of the destination buffer, leading to a single byte write beyond the intended memory range.\nDuring the parsing phase, if an attacker provides a queue name that exactly matches the defined maximum length of the internal buffer, the routine inadvertently increments the index or writes an additional character into the adjacent memory location. In a C-based environment typical of these daemons, this off-by-one overwrite often corrupts critical process metadata, such as adjacent pointers, saved frame pointers, or nearby flags stored on the stack or heap.\nThe attack flow proceeds as follows: First, the local authenticated attacker invokes an LPD request, such as a print submission command, while specifying a crafted queue name parameter. Second, the LPD parser routine processes this input without adequate bounds enforcement. Third, the off-by-one write operation occurs, modifying the memory adjacent to the input buffer. Fourth, the corruption leads to a segmentation fault or a critical state inconsistency within the LPD process memory space, forcing the daemon to crash. Because this occurs within a system-level component, the stability of the associated printer subsystem is compromised, resulting in a denial-of-service condition for users relying on LPD services.\nThe vulnerability affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The scope is restricted to local authenticated attackers, meaning the adversary must already have a valid user session on the target system. Because the LPD service runs with specific system privileges, the failure of this process can propagate system instability. The primary constraint for successful exploitation is the ability to influence the LPD parser with input that triggers the out-of-bounds boundary condition, necessitating precise alignment of the malicious input string relative to the internal buffer allocation."
}