CVE-2026-17226

This CVE presents as a medium-severity authenticated out-of-bounds read, but the IBM i context fundamentally changes the risk calculus. The platform runs core banking, ERP, and healthcare workloads where 'authenticated' is a lower bar than it sounds — QSECOFR defaults, weak service account passwords, and profile inheritance creating unintended privilege chains are structural patterns, not edge cases. An out-of-bounds read here doesn't just leak process memory. IBM i's shared memory pool architecture means one job reading out of bounds can access data from other jobs running database connections, active transactions, and authentication tokens still resident in memory. The dual outcome — information disclosure OR denial of service — signals inconsistent out-of-bounds behavior typical of length/offset parsing errors, meaning an attacker may influence both what gets read and how far out of bounds. This isn't a contained memory safety failure; a crash in one job can cascade through jobq dependencies, active batch streams, and database commitment cycles sharing that pool. The vulnerability spans IBM i 7.3 through 7.6 — that's four major versions with this bug surviving multiple development cycles, which suggests a parsing path nobody actively owns or reviews. Given intensifying IBM i security research and the platform's notoriously slow patching cadence, the exposure window after disclosure compounds with every other unpatched flaw. Prioritize patching on systems exposed to network interfaces this affects, and pressure-test whether your IBM i deployment has weak service accounts or shared profiles that make 'authenticated' a thin constraint in practice.

Reviewed through automated stages and approved by a human before publication.