Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.
Published: 2026-09-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply PTF
AI Analysis

Impact

IBM i versions 7.3 through 7.6 have a flaw in the Line Printer Daemon (LPD) queue name parser that can be triggered by an off‑by‑one write. A local authenticated attacker can exploit this to cause a denial of service, halting printer service functionality.

Affected Systems

The affected products are IBM i running releases 7.3, 7.4, 7.5, or 7.6. For each release the recommended fix is a specific IBM PTF: SJ11300 for 7.6, SJ11301 for 7.5, SJ11302 for 7.4, and SJ11303 for 7.3.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity; the EPSS score is 0.00278 (< 1%), indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local authentication to the IBM i system, meaning that users with sufficient privileges can trigger the denial of service by sending a crafted queue name to the LPD service. No remote exploitation is described, so the threat is confined to environments where local authenticated users have service‑management credentials.

Generated by OpenCVE AI on September 10, 2026 at 04:44 UTC.

Remediation

Vendor Solution

IBM i Release5770-TC1  PTF Number(s)PTF Download Link(s)7.6SJ11300 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11300 7.5SJ11301 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11301 7.4SJ11302 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11302 7.3SJ11303 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11303 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.


OpenCVE Recommended Actions

  • Apply the IBM i Release5770‑TC1 PTF that corresponds to your version (SJ11300 for 7.6, SJ11301 for 7.5, SJ11302 for 7.4, SJ11303 for 7.3).
  • Restrict local user accounts so that only authorized personnel can access and use the LPD service, limiting the number of accounts that can send queue names.
  • If the LPD service is not required for operational purposes, disable or remove the service and uninstall unused printer drivers to eliminate the vulnerable code path.

Generated by OpenCVE AI on September 10, 2026 at 04:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 09 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-193
CPEs cpe:2.3:o:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.6:*:*:*:*:*:*:*

Fri, 04 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to an off-by-one write in the LPD queue name parser.
Title IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ]
First Time appeared Ibm
Ibm i
Weaknesses CWE-787
CPEs cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}


cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-08T17:28:11.353Z

Reserved: 2026-07-25T20:50:08.481Z

Link: CVE-2026-17469

cve-icon Vulnrichment

Updated: 2026-09-08T17:28:07.211Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-04T17:16:54.487

Modified: 2026-09-09T16:00:50.560

Link: CVE-2026-17469

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T04:45:16Z

Weaknesses