CVE-2026-17649

The EPSS score of 0.0024 for this out-of-bounds read vulnerability signals low opportunistic exploitation likelihood—not because the code defect is theoretical, but because reaching this path requires conditions that exist only within IBM i's closed topology. That architectural barrier is itself diagnostic: our severity frameworks systematically misprice risks in walled-garden platforms where the system isn't typically internet-adjacent. This OOB read scores 5.3 MEDIUM under CVSS, but the fortress framing that produces that score is temporally fragile. Modernization initiatives—REST APIs, cloud interconnections, third-party integrations—are eroding the isolation model that makes this appear contained. Each integration point punches holes in the fortress wall, and more importantly, adds paths OUT for whatever this read exposes. The more uncomfortable reality: out-of-bounds reads frequently ARE the escalation mechanism, not just aids to it. This read can leak ASLR offsets, stack cookies, or credentials from adjacent memory regions—turning modest access into meaningful lateral movement. The question that determines your actual exposure: what memory regions are adjacent to this read, and do they contain credentials or structures that grant access to the financial cores, clinical systems, or manufacturing ERPs that IBM i typically runs? If so, this isn't lateral movement aid—it's a fuse to detonation. IBM i's documented history of OOB read/write CVEs across network-adjacent subsystems over the past decade confirms this isn't an isolated defect. It's pattern evidence. The platform's value proposition is continuity—running code from the 1980s unchanged—compiled with toolchains that lacked modern mitigations. Every year of working code staying working is another year of memory-unsafe patterns compounding. The critical question for your remediation: did IBM's fix address the root cause or just this instance? If they patched only the specific source without enabling compiler hardening or recompiling with modern mitigations, they've fixed a symptom while leaving the underlying memory-unsafe patterns intact. The next similar bug in the same codebase is waiting to be CVE-d. The EPSS score measures attacker economics today, not what happens when a determined actor decides your IBM i deployment is the path to their objective. Organizations running banking cores or hospital systems should treat the MEDIUM rating as a minimum floor, not a ceiling—and should prioritize understanding their specific exposure profile before anchoring on score as evidence of contained risk.

Reviewed through automated stages and approved by a human before publication.