Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T21:17:04.350Z",
  "pubdate": "2026-09-14T21:17:04.350Z",
  "executiveSummary": "This vulnerability involves a buffer overflow condition within the Portable Application Solutions Environment (PASE) on IBM i platforms.\nThe flaw allows an authenticated local attacker to trigger a denial of service (DoS) state by specifically targeting a PASE process.\nThe vulnerability affects IBM i versions 7.3, 7.4, 7.5, and 7.6.\nThe primary impact is the forced termination of the affected PASE process, which may lead to service instability depending on the nature of the process involved.\nExploitation is limited to authenticated users, meaning an adversary must already possess legitimate system access to initiate the attack sequence.\nThe risk is primarily centered on local service availability and process integrity rather than unauthorized remote code execution or privilege escalation.\nThe technical requirement for exploitation involves the ability to interface with PASE-compliant binaries or system interfaces to trigger the out-of-bounds memory write.",
  "technicalDetails": "The root cause of the vulnerability is a memory safety flaw within a PASE process on the IBM i operating system. PASE is a runtime environment that allows AIX applications to execute on IBM i. The identified buffer overflow occurs when the process fails to properly validate the length of user-supplied data before copying it into a fixed-length memory buffer, typically located on the stack or in the heap.\nThe exploitation flow initiates when an authenticated attacker invokes a vulnerable PASE process or function. By providing a crafted input—specifically a payload designed to exceed the allocated boundary of the target buffer—the attacker overwrites adjacent memory structures. In this specific scenario, the overflow disrupts the execution flow or corrupts critical process state information, leading to an unhandled exception or a signal that forces the process to terminate prematurely.\nBecause PASE processes share a specific address space architecture on IBM i, the corruption of process memory does not necessarily cross into the kernel space, but it does result in the immediate denial of service of the affected process. The vulnerability is constrained by the authentication requirement, as an attacker must have sufficient privileges to execute or interact with the vulnerable process through standard system interfaces.\nAffected versions include 7.3, 7.4, 7.5, and 7.6. The attack does not inherently require network exposure, as the process interaction is typically local to the IBM i environment. The payload behavior is focused strictly on triggering the overflow; there is no evidence provided that the overflow is currently being leveraged for arbitrary code execution. The post-exploitation impact is limited to the termination of the targeted process, which effectively causes a local denial of service for the services hosted within that specific PASE instance."
}