Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow.
Published: 2026-09-04
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption
Action: Immediate Patch
AI Analysis

Impact

An integer underflow in IBM i 7.6, 7.5, 7.4, and 7.3 can cause a buffer overflow exploited by an authenticated remote attacker to corrupt system memory, compromising confidentiality and integrity of the affected system.

Affected Systems

IBM i 7.6, 7.5, 7.4, and 7.3 are vulnerable. The vendor recommends applying the PTFs MJ11326 (for 7.6), MJ11327 (for 7.5), MJ11328 (for 7.4), and MJ11329 (for 7.3). Unsupported releases should be upgraded to IBM i 5770‑999.

Risk and Exploitability

The CVSS score of 6.3 reflects moderate impact. The EPSS score of less than 1% indicates a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Attacker must have valid credentials and remote access. The risk warrants immediate remediation.

Generated by OpenCVE AI on September 10, 2026 at 06:05 UTC.

Remediation

Vendor Solution

IBM i Release5770-999  PTF Number(s)PTF Download Link(s)7.6MJ11326 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ11326 7.5MJ11327 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ11327 7.4MJ11328 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ11328 7.3MJ11329 https://www.ibm.com/mysupport/s/fix-information?legacy=MJ11329 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.

OpenCVE Recommended Actions

  • Apply the appropriate PTF to your IBM i version using IBM’s Fix Information portal.
  • If your system runs an unsupported release, upgrade to IBM i 5770‑999, which contains the fix.
  • Reduce the attack surface by limiting remote authenticated access to trusted accounts and disabling unused IBM i services that could expose the flaw.

Generated by OpenCVE AI on September 10, 2026 at 06:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-191
CPEs cpe:2.3:o:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:o:ibm:i:7.6:*:*:*:*:*:*:*

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow.
Title IBM i is Affected By Buffer Overflow Vulnerability []
First Time appeared Ibm
Ibm i
Weaknesses CWE-122
CPEs cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Ibm I
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-04T16:44:08.152Z

Reserved: 2026-07-29T22:02:45.732Z

Link: CVE-2026-18341

cve-icon Vulnrichment

Updated: 2026-09-04T16:44:01.540Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-04T17:16:56.283

Modified: 2026-09-08T19:38:47.970

Link: CVE-2026-18341

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T06:15:17Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow

  • CWE-191

    Integer Underflow (Wrap or Wraparound)