CVE-2026-17270: IBM i Stack Buffer Overflow Vulnerability

CVE-2026-17270 Overview

CVE-2026-17270 is a stack-based buffer overflow vulnerability [CWE-121] affecting multiple versions of the IBM i operating system. A local, authenticated attacker can trigger the overflow to cause a denial of service on the affected system. The flaw impacts IBM i versions 7.3, 7.4, 7.5, and 7.6. IBM published the advisory on their support portal and NVD listed the entry on 2026-09-04.

Critical Impact
A local attacker with low privileges can crash the affected IBM i system, disrupting availability of hosted workloads and business applications.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17270 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-17270

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in IBM i. Stack-based overflows occur when a program writes data beyond the bounds of a fixed-size buffer allocated on the call stack. The write corrupts adjacent stack memory, including saved return addresses and control data. In this case, the corruption produces a denial of service condition rather than code execution, as reflected by the availability-only impact.

The attack requires local access and low-privileged authentication, with no user interaction. IBM's advisory documents the affected components and fix levels on the IBM Support Page.

Root Cause

The root cause is missing or inadequate bounds checking on input processed by an IBM i component that writes to a stack-allocated buffer. When input length exceeds the allocated space, the write operation overwrites adjacent stack frames and triggers an abnormal program termination.

Attack Vector

Exploitation requires an authenticated local account on the IBM i system. The attacker supplies crafted input to the vulnerable component to overflow the target buffer. Successful exploitation halts the affected process or system, denying service to legitimate users. No remote or unauthenticated exploitation path is documented, and no public proof-of-concept is available.

No verified exploit code is available. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-17270

Indicators of Compromise

Unexpected abnormal termination of IBM i system jobs or subsystems on affected releases.
System operator messages indicating a program exception, function check, or MCH exception on the affected component.
Repeated job failures originating from a specific low-privileged user profile.

Detection Strategies

Monitor the QSYSOPR message queue and history log (DSPLOG) for MCH-class exceptions and function checks correlated with user activity.
Baseline normal job termination patterns and alert on anomalous crashes tied to non-privileged user profiles.
Correlate authentication events with subsequent process failures to identify potential local exploitation attempts.

Monitoring Recommendations

Forward IBM i audit journal (QAUDJRN) entries to a centralized SIEM for correlation and long-term retention.
Track user profiles that repeatedly trigger job failures on the affected releases and review their command usage.
Alert on service disruptions affecting critical subsystems following authenticated local user activity.

How to Mitigate CVE-2026-17270

Immediate Actions Required

Apply the IBM-provided PTFs for IBM i 7.3, 7.4, 7.5, and 7.6 as documented in the vendor advisory.
Inventory all IBM i systems and confirm which releases and cumulative PTF levels are deployed.
Restrict local interactive access to trusted administrators until patches are installed.

Patch Information

IBM has released fixes for the affected IBM i releases. Review the remediation guidance and required PTF group levels on the IBM Support Page and apply them through your standard IBM i PTF management process.

Workarounds

Reduce the number of user profiles with local sign-on capability on affected systems.
Enforce least privilege by removing unnecessary special authorities from standard user profiles.
Increase auditing on the affected releases using CHGSYSVAL SYSVAL(QAUDLVL) to capture authority and program failure events pending patch deployment.

bash

# Configuration example - IBM i PTF verification
DSPPTF LICPGM(5770SS1)
WRKPTFGRP