This vulnerability is a stack-based buffer overflow that enables a remote attacker, through Simple Mail Transfer Protocol traffic, to crash an IBM i system and deny service to legitimate users. The flaw arises when the SMTP component fails to properly bound input data, allowing the attacker to overflow the stack and cause an abrupt termination of the SMTP service, which in turn can cascade to overall system instability. The lack of proper input validation is the root cause of the exploitability, as identified by the associated CWE-787.

IBM i releases 7.3, 7.4, 7.5, and 7.6 are impacted. The specific patch levels are available through IBM PTFs SJ11061 and SJ11131 for 7.6, SJ11074 and SJ11129 for 7.5, SJ11083 and SJ11127 for 7.4, and SJ11084 and SJ11123 for 7.3. Users running unsupported versions should upgrade to a supported release that incorporates these fixes.

The CVSS score of 7.5 places this flaw in the high severity range, and while an EPSS score is not available, there is no evidence of widespread exploitation and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be Remote Network, specifically via SMTP traffic, given the description of the overflow occurring during mail transfer processing. An attacker with network access to the server could trigger a DoS by sending crafted SMTP commands that trigger the buffer overflow, leading to a crash of the SMTP service and potentially broader system unavailability.