Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T21:17:43.933Z",
  "pubdate": "2026-08-13T21:17:43.933Z",
  "executiveSummary": "An off-by-one error in bounds checking exists within IBM i versions 7.6, 7.5, 7.4, and 7.3, potentially allowing a remote attacker to cause a denial of service condition. This vulnerability arises from improper memory boundary validation during the processing of inputs or data structures within the affected operating system components.\nThe primary impact of this flaw is system instability or service disruption, manifested as a denial of service. The risk implication centers on the potential interruption of critical business operations hosted on the IBM i platform. Attackers capable of reaching the vulnerable service over the network can trigger the condition without necessarily requiring complex authentication or elevated privileges, depending on the specific network exposure of the underlying daemon or protocol handler.\nExploitation requirements generally involve sending a maliciously crafted sequence of data or requests designed to exploit the off-by-one indexing error, leading to memory corruption or application crashes. Remediation relies on applying vendor-supplied fixes or patches as soon as they become available from IBM.",
  "technicalDetails": "The vulnerability is rooted in an off-by-one error during bounds checking operations within affected binaries or services in IBM i 7.6, 7.5, 7.4, and 7.3. Specifically, the flaw occurs when the software calculates buffer sizes or array indices, allowing a pointer or loop counter to exceed the intended allocation boundary by exactly one byte or element. This typically happens during string manipulation, loop termination evaluation, or memory copy routines where the null terminator or the final boundary condition is incorrectly accounted for.\nFrom an attack flow perspective, a remote threat actor initiates network communication with a vulnerable service exposed by the IBM i operating system. The attacker transmits a specifically crafted payload designed to interact with the vulnerable parsing or processing routine. As the routine executes, the off-by-one calculation error is triggered, causing the system to read or write out-of-bounds memory. Depending on the memory layout and the specific target variable affected, this out-of-bounds access corrupts adjacent memory structures, heap metadata, or control flow data.\nThe vulnerable components are internal system libraries or network-facing daemons responsible for handling specific protocol interactions or data parsing within IBM i versions 7.6, 7.5, 7.4, and 7.3. Network exposure depends on the specific service utilizing the flawed code, but remote exploitation implies that the attack surface is accessible over the network interface without prior local access. Authentication and privilege requirements vary by the specific exposed service, but many such denial of service vulnerabilities can be triggered by unauthenticated remote clients interacting with standard system daemons.\nThe payload behavior centers on inducing fatal exceptions, segmentation faults, or memory access violations within the affected process. When the out-by-one write or read destabilizes critical runtime memory, the operating system or service crashes immediately to prevent further memory corruption, resulting in a denial of service. Post-exploitation impact is primarily limited to service unavailability or system reboots, though off-by-one memory corruption vulnerabilities can theoretically present risks of remote code execution if heap or stack layouts permit precise control over adjacent overwritten data."
}