Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-13T21:17:45.220Z",
  "pubdate": "2026-08-13T21:17:45.220Z",
  "executiveSummary": "This vulnerability is a stack-based buffer overflow affecting the Native IBM i JSSE provider in IBM i versions 7.3, 7.4, 7.5, and 7.6.\nThe flaw stems from improper bounds checking during the TLS session establishment phase, which allows a local attacker to overflow a fixed-length memory buffer.\nSuccessful exploitation of this vulnerability enables a local, authenticated attacker to execute arbitrary code within the context of the affected Java Virtual Machine (JVM) process or induce a denial of service through application crashes.\nThe risk implication is severe, as arbitrary code execution at the JVM level can potentially lead to privilege escalation, unauthorized system access, or compromise of sensitive cryptographic operations and data managed by the runtime environment.\nExploitation requires local access to the target system along with valid authentication credentials capable of interacting with the vulnerable TLS session establishment mechanisms.\nNo specific network exposure beyond local authentication prerequisites is mandated by the direct mechanics of this buffer overflow vector.",
  "technicalDetails": "The root cause of the vulnerability resides in the Native IBM i JSSE (Java Secure Socket Extension) provider component, specifically within memory management routines handling TLS session establishment.\nDuring the handshake or parameter processing phases of TLS negotiation, the native code copies input data into a fixed-length stack-based buffer without performing adequate bounds checking or verifying the size of the incoming data against the maximum capacity of the destination buffer.\nThe vulnerable component is the Native IBM i JSSE provider integrated into the Java Virtual Machine runtimes across the specified IBM i operating system versions.\nAffected software versions include IBM i 7.3, 7.4, 7.5, and 7.6.\nPrerequisites for exploitation mandate that an attacker possesses local access to the host system and valid authentication credentials to execute or interact with applications leveraging the native JSSE provider.\nThe attack flow begins when the malicious or manipulated local user initiates or interacts with a TLS session establishment process handled by the native JSSE provider.\nThe attacker supplies a crafted payload designed to exceed the allocated boundaries of the fixed-length stack buffer during data parsing or cryptographic context initialization.\nAs the overly large input is copied into the stack buffer, adjacent stack memory—including return addresses and saved frame pointers—is overwritten.\nWhen the affected function attempts to return execution control, the modified return address redirects the instruction pointer to attacker-controlled shellcode or arbitrary code included within the payload.\nPost-exploitation impact includes the execution of arbitrary code with the privileges of the executing JVM process, or alternatively, memory corruption leading to an immediate JVM process crash and resulting denial of service for dependent services."
}