Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-04T17:16:55.760Z",
  "pubdate": "2026-09-04T17:16:55.760Z",
  "executiveSummary": "A memory leak vulnerability has been identified within IBM i versions 7.3, 7.4, 7.5, and 7.6 that permits a remote, authenticated attacker to trigger a Denial of Service (DoS) condition.\nThe vulnerability stems from improper memory management within the system, allowing an attacker to exhaust available system resources through repeated, unauthorized requests.\nSuccessful exploitation results in the depletion of critical memory pools, potentially leading to system instability, service degradation, or a complete crash of the affected IBM i environment.\nThis vulnerability is restricted to remote attackers who possess valid system authentication; it cannot be exploited by unauthenticated, anonymous entities.\nThe risk implication is significant for high-availability environments where consistent uptime and resource management are mandatory.\nOrganizations are advised to prioritize the application of official vendor security patches and monitor system memory utilization to detect patterns indicative of exploitation attempts.",
  "technicalDetails": "The vulnerability is characterized as a memory leak originating from flawed resource handling during specific authenticated operations on IBM i platforms.\nIn a memory leak scenario, the system allocates memory for a specific request or process but fails to release that memory back to the heap once the operation completes or fails. Under normal circumstances, this is a minor background concern; however, when the allocation routine is triggered repeatedly by an authenticated attacker, the system experiences a steady, cumulative decline in available memory resources.\nThe attack flow requires the adversary to establish an authenticated session with the target IBM i system. Upon successful authentication, the attacker interacts with the vulnerable interface or subsystem—likely a background daemon or service process—by sending a sequence of crafted requests designed to initiate the faulty memory allocation path.\nBecause each request contributes to the accumulation of 'orphan' memory segments, the system gradually exhausts its physical or virtual address space. Once the memory pressure crosses a critical threshold, the kernel or relevant middleware may encounter allocation failures, triggering kernel panics, service hangs, or complete system failure as legitimate processes are starved of the necessary memory to function.\nThe root cause is localized to the lifecycle management of objects or memory buffers within the IBM i codebase. Affected versions include 7.3, 7.4, 7.5, and 7.6. The exploitation process is deterministic; an attacker can purposefully maintain a slow, steady leak to evade immediate detection, or perform a rapid flood of requests to force an immediate DoS event.\nPost-exploitation impact is limited to resource exhaustion and service unavailability. The vulnerability does not inherently grant the attacker elevated privileges or unauthorized data access; rather, it weaponizes the exhaustion of hardware constraints to degrade the system’s utility. Forensic analysis of system logs may reveal an anomalous increase in process memory usage over time, correlating with the session timestamps of the authenticated user. Remediation necessitates the deployment of specific program temporary fixes (PTFs) issued by IBM to correct the memory leak condition in the impacted subsystem."
}