CVE-2026-18249

This vulnerability is a JNI boundary failure where pointers originating from Java-controlled addresses flow to native code that dereferences them without validation. This is not a one-off coding error—it represents a systemic flaw in how IBM's Java runtime exposes native functionality: the API creates an implicit contract requiring Java callers to validate pointer values before passing them across the boundary, but Java developers have no visibility into what native code downstream will do with those addresses. That's an abstraction failure, not a developer mistake. The authenticated-attacker qualifier matters significantly for prioritization. This isn't a code injection vector—it requires existing credentials. However, once an attacker has any valid IBM i credentials, this vulnerability provides direct privilege escalation. In IBM i environments, this is particularly severe because the platform often hosts ERP systems, financial ledgers, and in some cases process control infrastructure. Elevated privileges on IBM i unlock access to systems that dwarf typical database escalation. The likely root cause is legacy code from IBM i's AS/400 lineage where Java-native interop was designed under different security assumptions. This pattern—JNI pointer-passing without boundary validation—has recurred across JVM implementations for over two years, suggesting IBM's codebase likely contains similar forgotten contracts that haven't been exploited yet. **Prioritize these actions now**: First, identify any custom Java code calling native APIs that accept memory addresses or buffers—audit JNI usage patterns in your application layer. Second, review which IBM i user profiles have Java execution authority and whether those profiles have broader system privileges than necessary. Third, contact IBM for remediation timeline; given IBM i's change-window patching model, the window between patch availability and full deployment across HA configurations will be substantial. Assume this has been exploitable for years and plan incident response accordingly.

Reviewed through automated stages and approved by a human before publication.