Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking.
Published: 2026-08-19
Score: 3.5 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability permits a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking. This memory corruption could lead to unexpected code execution or system compromise, based on the nature of a buffer overwrite. The description does not detail the exact exploitation outcome, but the potential for arbitrary code execution is inferred.

Affected Systems

IBM i operating system versions 7.3, 7.4, 7.5, and 7.6 are affected. The product is IBM:i and the affected releases include 7.3 to 7.6.

Risk and Exploitability

The CVSS score of 3.5 indicates low severity. EPSS is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attack requires a remote authenticated session; therefore, only users with valid credentials can exploit it. The exploit could overwrite adjacent memory, potentially allowing arbitrary code execution, but no public proof of concept or alleged exploitation has been reported.

Generated by OpenCVE AI on August 20, 2026 at 11:06 UTC.

Remediation

Vendor Solution

IBM i Release5770-999 PTF Number(s)PTF Download Link(s)7.6MJ10886 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10886 7.5MJ10885 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10885 7.4MJ10884 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10884 7.3MJ10883 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ10883 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.


OpenCVE Recommended Actions

  • Apply the applicable IBM i PTF for your version—e.g., MJ10886 for 7.6, MJ10885 for 7.5, MJ10884 for 7.4, or MJ10883 for 7.3.
  • Upgrade to IBM i Release5770-999 or a supported, fixed release if your version is no longer supported.
  • Restrict remote authenticated access to the affected system by using network segmentation or firewall rules to limit potential attackers.

Generated by OpenCVE AI on August 20, 2026 at 11:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 19 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking.
Title IBM i Buffer Overflow
First Time appeared Ibm
Ibm i
Weaknesses CWE-122
CPEs cpe:2.3:o:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-20T16:27:37.265Z

Reserved: 2026-07-28T17:33:47.769Z

Link: CVE-2026-18102

cve-icon Vulnrichment

Updated: 2026-08-20T16:24:41.397Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T21:16:54.270

Modified: 2026-08-24T19:34:30.877

Link: CVE-2026-18102

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T11:15:03Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow