Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T21:17:44.067Z",
  "pubdate": "2026-08-13T21:17:44.067Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw in IBM i operating system versions 7.3, 7.4, 7.5, and 7.6, stemming from a byte-count and element-count confusion error.\nA remote attacker can leverage this flaw to harvest sensitive information from vulnerable systems without requiring prior authentication or elevated privileges.\nThe root mechanism relies on a discrepancy in how data boundaries or array sizes are calculated, leading to memory reading out-of-bounds or unintended data exposure.\nSuccessful exploitation exposes confidential system data, potentially aiding attackers in planning subsequent sophisticated campaigns against the enterprise infrastructure.\nThe risk implication is moderate to high depending on the sensitivity of the data exposed during the transaction or network communication.\nRemediation requires applying official vendor-supplied fixes or security bulletins as soon as they become available from IBM.",
  "technicalDetails": "The vulnerability resides in the core components of IBM i versions 7.3, 7.4, 7.5, and 7.6, specifically within routines that handle memory buffers, data serialization, or network protocol parsing where sizing discrepancies occur.\nThe root cause is identified as a byte-count and element-count confusion. This logical defect occurs when an application or kernel routine confuses the number of array elements with the total size in bytes when processing data structures.\nWhen a remote attacker interacts with the vulnerable service, they can supply meticulously crafted inputs that exploit this mathematical mismatch during size validation checks.\nAs a result of the confusion, the underlying function allocates or processes memory based on mismatched parameters, allowing the reading of adjacent memory regions or returning excess data structures to the client.\nAttack flow begins with network exposure where the remote attacker sends a specially constructed request targeting the vulnerable service over supported protocols.\nUpon receiving the payload, the vulnerable component fails to properly validate the byte-count versus element-count constraints, leading to an over-read condition.\nThe post-exploitation impact includes the leakage of sensitive internal memory contents, which may contain configuration data, session tokens, or other confidential operational artifacts.\nNo authentication or special privilege requirements are inherently mandated by the vulnerability mechanics for remote interaction, enabling unauthenticated remote actors to trigger the condition if network access to the service is available."
}