{"id":"CVE-2026-115501","kind":"vulnerability","aliases":["CVE-2026-115501"],"related":[],"title":"IBM i: stack buffer overflow in QFileSvr.400 file system lets local users crash or misbehave","description":"IBM i 7.3 7.4, 7.5, and 7.6 is vulnerable to a stack buffer overflow, caused by improper bounds checking in the QFileSvr.400 file system. By sending a command in the QFileSvr.400 file system, a local authenticated attacker could cause undefined behavior.","summary":"IBM i versions 7.3 through 7.6 have a stack buffer overflow caused by missing bounds checks in the QFileSvr.400 file system. A local attacker with valid credentials can send a crafted command that causes undefined behavior.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["as400","ibm-i","infrastructure"],"not_affected_if":["no-local-accounts","other-ibm-i-versions"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","triaged_at":"2026-11-13T22:34:43+00:00","updated_at":"2026-11-13T22:34:43+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-13T22:34:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"IBM i: stack buffer overflow in QFileSvr.400 file system lets local users crash or misbehave","impact":"medium","summary":"IBM i versions 7.3 through 7.6 have a stack buffer overflow caused by missing bounds checks in the QFileSvr.400 file system. A local attacker with valid credentials can send a crafted command that causes undefined behavior.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-i","as400"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local authenticated user causes undefined behavior, possibly crashing the system","analyst_note":"Check the IBM security bulletin for CVE-2026-115501 for fixed PTFs and the exact affected configuration; the NVD entry alone gives no fix.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts","other-ibm-i-versions"],"who_is_affected":"Only IBM i systems on versions 7.3, 7.4, 7.5 or 7.6 are named in the sources. The attacker must already be authenticated on the local system, so exposure depends on who holds valid accounts there. The sources do not say which configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4573,"output_tokens":500,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115501':18A,21A '-2026':17A,20A '7.3':30B,65C '7.4':66C '7.5':67C '7.6':32B,69C 'as400':22B 'attack':50B,99C 'authent':98C 'behavior':62B,103C 'bound':41B,80C 'buffer':4A,36B,75C 'caus':38B,60B,77C,101C 'check':42B,81C 'command':58B,90C 'could':100C 'craft':57B 'crash':13A 'credenti':53B 'cve':16A,19A 'file':8A,46B,85C,94C 'ibm':1A,24B,27B,63C 'ibm-i':23B 'improp':79C 'infrastructur':26B 'let':10A 'local':11A,49B,97C 'misbehav':15A 'miss':40B 'overflow':5A,37B,76C 'qfilesvr.400':7A,45B,84C,93C 'send':55B,88C 'stack':3A,35B,74C 'system':9A,47B,86C,95C 'undefin':61B,102C 'user':12A 'valid':52B 'version':29B 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Only IBM i systems on versions 7.3, 7.4, 7.5 or 7.6 are named in the sources. The attacker must already be authenticated on the local system, so exposure depends on who holds valid accounts there. The sources do not say which configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["as400","ibmi","infrastructure","medium"],"campaign_type":null,"search_a":"'-115501':18A,21A '-2026':17A,20A 'buffer':4A 'crash':13A 'cve':16A,19A 'file':8A 'ibm':1A 'let':10A 'local':11A 'misbehav':15A 'overflow':5A 'qfilesvr.400':7A 'stack':3A 'system':9A 'user':12A","search_b":"'7.3':30B '7.6':32B 'as400':22B 'attack':50B 'behavior':62B 'bound':41B 'buffer':36B 'caus':38B,60B 'check':42B 'command':58B 'craft':57B 'credenti':53B 'file':46B 'ibm':24B,27B 'ibm-i':23B 'infrastructur':26B 'local':49B 'miss':40B 'overflow':37B 'qfilesvr.400':45B 'send':55B 'stack':35B 'system':47B 'undefin':61B 'valid':52B 'version':29B","search_c":"'7.3':65C '7.4':66C '7.5':67C '7.6':69C 'attack':99C 'authent':98C 'behavior':103C 'bound':80C 'buffer':75C 'caus':77C,101C 'check':81C 'command':90C 'could':100C 'file':85C,94C 'ibm':63C 'improp':79C 'local':97C 'overflow':76C 'qfilesvr.400':84C,93C 'send':88C 'stack':74C 'system':86C,95C 'undefin':102C 'vulner':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115501","severity":null,"published_at":"2026-11-13T22:17:21+00:00","modified_at":"2026-11-13T22:17:21+00:00","first_seen_at":"2026-11-13T22:33:34+00:00","fetched_at":"2026-11-13T22:33:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}