CVE-2026-17469: IBM i LPD Parser Denial of Service Vulnerability

CVE-2026-17469 Overview

CVE-2026-17469 is a denial-of-service vulnerability in IBM i that stems from an off-by-one write in the Line Printer Daemon (LPD) queue name parser. A local authenticated attacker can trigger the flaw to disrupt service availability on affected systems. The issue affects IBM i releases 7.3, 7.4, 7.5, and 7.6, which are widely deployed on IBM Power servers for mission-critical business workloads. The vulnerability maps to two related weakness classes: an out-of-bounds write [CWE-787] caused by an off-by-one error [CWE-193]. Exploitation requires only low privileges and no user interaction, but the attack vector is local.

Critical Impact
A local authenticated user can crash the LPD service, causing denial of service to print spooling functionality on IBM i systems.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17469 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-17469

Vulnerability Analysis

The vulnerability resides in the queue name parsing logic of the IBM i Line Printer Daemon (LPD). LPD is a network print service that historically accepts queue names supplied by remote clients or local callers. When the parser processes a queue name, it writes one byte beyond the bounds of an allocated buffer. This off-by-one write corrupts adjacent memory and destabilizes the LPD service, resulting in a denial of service. The confidentiality and integrity of data are not directly impacted, but availability of print services is disrupted.

Root Cause

The root cause is an off-by-one error [CWE-193] in the LPD queue name parser that leads to an out-of-bounds write [CWE-787]. The parser miscalculates the terminator or boundary condition when handling queue name input, writing a single byte past the end of a fixed-size buffer. This class of error typically arises from mixing zero-based and one-based length calculations or from failing to reserve space for a null terminator.

Attack Vector

Exploitation requires local access with valid credentials on the IBM i system. An authenticated attacker submits a crafted queue name to the LPD parser, triggering the boundary violation. No user interaction is required. Successful exploitation causes the LPD service or dependent process to become unavailable, disrupting print workflows and any downstream jobs that rely on spooled output.

No public proof-of-concept exploit is available. Refer to the IBM Security Support Document for vendor-supplied technical details.

Detection Methods for CVE-2026-17469

Indicators of Compromise

Unexpected termination or restart of the LPD subsystem or QSPL spool-related jobs on IBM i.
Abnormal entries in QHST history log or job logs referencing LPD queue processing failures.
Repeated LPD connection attempts from a single local authenticated user followed by service disruption.

Detection Strategies

Monitor IBM i job logs and system operator messages for LPD subsystem crashes or abends correlated with print queue submissions.
Audit QAUDJRN security journal entries for anomalous activity by low-privilege users interacting with print services.
Correlate authentication events with LPD service state changes to identify potential abuse patterns.

Monitoring Recommendations

Forward IBM i audit journal and system operator messages to a centralized SIEM for continuous analysis.
Establish a baseline for LPD service uptime and alert on unexpected restarts or process crashes.
Track queue name inputs of unusual length or containing non-standard characters submitted by authenticated users.

How to Mitigate CVE-2026-17469

Immediate Actions Required

Apply IBM-provided PTFs for IBM i 7.3, 7.4, 7.5, and 7.6 as documented in the vendor advisory.
Restrict interactive and network access to accounts that require LPD functionality, following least-privilege principles.
Review and reduce the set of local user profiles authorized to submit print jobs via LPD.

Patch Information

IBM has published remediation guidance in the IBM Security Support Document. Administrators should install the group PTFs referenced by IBM for each affected release (7.3, 7.4, 7.5, 7.6) and verify installation through standard PTF inventory commands.

Workarounds

Disable the LPD service using CHGTCPSVR SVRSPCVAL(*LPD) AUTOSTART(*NO) and ENDTCPSVR SERVER(*LPD) where print services are not required.
Restrict network reachability to the LPD listener (TCP port 515) via IBM i exit programs or perimeter firewall rules.
Limit *USE authority to print queue objects and remove unnecessary user profiles from groups with spool access.

bash

# Configuration example: disable the LPD server on IBM i
ENDTCPSVR SERVER(*LPD)
CHGTCPSVR SVRSPCVAL(*LPD) AUTOSTART(*NO)

# Verify PTF status for the current release
DSPPTF LICPGM(5770SS1)