CVE-2026-115501 · Infrastructure
NO FIX YET
IBM i versions 7.3 through 7.6 have a stack buffer overflow caused by missing bounds checks in the QFileSvr.400 file system. A local attacker with valid credentials can send a crafted command that causes undefined behavior.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only IBM i systems on versions 7.3, 7.4, 7.5 or 7.6 are named in the sources. The attacker must already be authenticated on the local system, so exposure depends on who holds valid accounts there. The sources do not say which configurations are affected.
Not affected if no-local-accounts, other-ibm-i-versions
Who cares as400, ibm-i
Unknown from the sources.
No fix yet, per the sources.
IBM i 7.3 7.4, 7.5, and 7.6 is vulnerable to a stack buffer overflow, caused by improper bounds checking in the QFileSvr.400 file system. By sending a command in the QFileSvr.400 file system, a local authenticated attacker could cause undefined behavior.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.