CVE-2026-18511
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a local authenticated attacker to trigger a stack-based buffer overflow in the native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.
Risk Assessment
The risk includes the possibility of arbitrary code execution by a local attacker, which could lead to full system compromise or disruption of JVM-based services.
Recommendation
It is recommended to apply IBM-provided fixes for IBM i immediately and restrict local access to trusted users only.
Original NVD description (English source)
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.