The vulnerability is a stack-based buffer overflow in IBM i’s Simple Mail Transfer Protocol implementation. When an attacker sends specifically crafted SMTP traffic, the overflow can trigger a crash or cause the process to terminate, leading to a denial of service. Because the overflow occurs in native code that handles email headers and data, it may allow the attacker to read or exfiltrate data from memory that is normally protected by the operating‑system boundary, potentially exposing sensitive configuration or user information. The impact is therefore twofold: an attacker can disrupt mail services and may gain access to confidential information stored in the process address space.

IBM i operating system releases 7.3 through 7.6 are affected. The basis of the fix is the public PTFs listed on IBM’s support portal: for 7.6 the relevant PTFs are SJ11061 and SJ11131; for 7.5 the PTFs are SJ11074 and SJ11129; for 7.4 the PTFs are SJ11083 and SJ11127; for 7.3 the PTFs are SJ11084 and SJ11123. Each release has a dedicated set of patches that must be applied to close the buffer‑overflow bug.

The CVSS score of 8.6 classifies this flaw as high severity. The EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog, suggesting that no widely‑known exploit has been observed yet. The most likely attack vector is remote, via network reachability to the SMTP service which is commonly exposed on port 25. An attacker with network access and the ability to send mail traffic to the IBM i system could trigger the overflow simply by sending a malformed MAIL FROM, RCPT TO, or DATA command. No local privilege escalation or authentication is required, so any system exposed to the Internet or an untrusted internal network is potentially vulnerable until the appropriate PTFs are installed.