A remote attacker can exploit an out-of-bounds read in IBM i NetServer to read sensitive data stored in memory. This flaw, identified as CWE‑125, can expose confidential information without requiring local system credentials. The vulnerability does not grant code execution or denial of service, but the potential loss of sensitive data is significant for enterprises relying on IBM i for critical operations.

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable. The advisory references PTFs MJ10939 (7.6), MJ10938 (7.5), MJ10937 (7.4), and MJ10936 (7.3). Users running unsupported or older releases should upgrade to a supported version that incorporates the fix.

The CVSS score of 5.3 reflects moderate severity. EPSS is not available, so current exposure probability is unknown, but the flaw is listed in an IBM advisory recommending immediate action. The attack vector is inferred to be remote, likely via the NetServer service exposed over the network, as the vulnerability was reported in the context of NetServer. The flaw has not been listed in the CISA KEV catalog, but the lack of exploitation evidence does not reduce the need for patching.