CVE-2026-19280: IBM i PASE Buffer Overflow Vulnerability

CVE-2026-19280 Overview

CVE-2026-19280 is a buffer overflow vulnerability affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. The flaw resides in a Portable Application Solutions Environment (PASE) process. An authenticated local attacker can trigger the overflow to terminate their own process, resulting in a denial of service condition. The vulnerability is classified under [CWE-787] (Out-of-bounds Write).

Critical Impact
An authenticated local user can trigger a buffer overflow in a PASE process, causing process termination and limited denial of service on affected IBM i systems.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-09-14 - CVE-2026-19280 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19280

Vulnerability Analysis

The vulnerability exists within a PASE process on IBM i. PASE provides an AIX runtime environment inside IBM i, allowing AIX binaries to execute alongside native workloads. A buffer overflow in this runtime component permits an authenticated attacker to write data beyond an allocated buffer boundary.

Exploitation impact is constrained. The attacker can only terminate their own process, not other users' processes or system services. However, the CVSS scope change indicates the vulnerable component and impacted component differ, reflecting the boundary crossing between PASE and IBM i process management.

Root Cause

The root cause is an out-of-bounds write [CWE-787] in a PASE process. The affected code fails to enforce proper bounds checking on a buffer, allowing adjacent memory to be overwritten. This corruption destabilizes process state and forces termination.

Attack Vector

The attack requires local access with valid authentication credentials on the IBM i system. No user interaction is required beyond the attacker's own actions. The attacker invokes the vulnerable PASE code path with crafted input that exceeds the target buffer, corrupting memory and causing the process to abort. IBM has not published exploit details in the public advisory.

Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-19280

Indicators of Compromise

Unexpected termination of PASE processes on IBM i systems running versions 7.3, 7.4, 7.5, or 7.6
Process abort or core dump entries in system logs tied to PASE runtime components
Repeated abnormal process exits associated with a single authenticated user session

Detection Strategies

Review IBM i job logs and QSYSOPR message queue for abnormal PASE job endings and unexpected MCH machine check messages
Correlate authenticated user sessions with process termination events to identify suspicious patterns
Enable audit journal (QAUDJRN) entries for job start and end events, focusing on PASE workloads

Monitoring Recommendations

Forward IBM i audit journal and system operator messages to a centralized SIEM for correlation
Alert on repeated PASE process failures originating from the same user profile within a short window
Track baseline PASE process termination rates and investigate statistically significant deviations

How to Mitigate CVE-2026-19280

Immediate Actions Required

Apply the IBM security update referenced in the vendor advisory as soon as it is available for your release level
Inventory all IBM i systems and confirm which are running versions 7.3, 7.4, 7.5, or 7.6
Restrict interactive and PASE shell access to trusted administrative users only
Review user profile authorities and remove unnecessary local access to reduce the pool of potential attackers

Patch Information

IBM has published remediation guidance on the IBM Support Page for CVE-2026-19280. Administrators should follow IBM's group PTF instructions for each affected IBM i release (7.3, 7.4, 7.5, and 7.6) and apply the corresponding fixes through standard PTF management procedures.

Workarounds

Limit which user profiles can invoke PASE (QP2SHELL, QP2TERM, and related interfaces) via object authority controls
Monitor and rate-limit process creation from non-administrative accounts to reduce abuse potential
Where feasible, disable interactive PASE access for user profiles that do not require it as a business function

bash

# Example: restrict PASE shell program authority on IBM i
GRTOBJAUT OBJ(QSYS/QP2TERM) OBJTYPE(*PGM) USER(*PUBLIC) AUT(*EXCLUDE)
GRTOBJAUT OBJ(QSYS/QP2SHELL) OBJTYPE(*PGM) USER(*PUBLIC) AUT(*EXCLUDE)
GRTOBJAUT OBJ(QSYS/QP2TERM) OBJTYPE(*PGM) USER(TRUSTEDADM) AUT(*USE)