CVE-2026-18846: 
NixOS vulnerability analysis and mitigation

CVE-2026-18846 is a buffer overflow vulnerability in IBM i (versions 7.3, 7.4, 7.5, and 7.6) caused by improper validation of client data in one of the platform's host servers. A remote, unauthenticated attacker can exploit this flaw by sending malformed requests to trigger a denial-of-service (DoS) condition, crashing or disabling the affected host server. The vulnerability was published on August 13, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, IBM Support).

The root cause is an out-of-bounds write (CWE-787) resulting from insufficient validation of data received from clients before it is written to an internal buffer. An attacker can exploit this by crafting and sending malformed network requests to the vulnerable IBM i host server, causing the server process to write beyond the bounds of an allocated buffer. No authentication, user interaction, or elevated privileges are required, and the attack can be performed remotely over the network with low complexity. No public proof-of-concept or detailed technical write-up has been identified at this time (GitHub Advisory, IBM Support).

Successful exploitation results in a denial-of-service condition for the targeted IBM i host server, causing it to crash or become unavailable. There is no reported impact on confidentiality or data integrity — the vulnerability is limited to availability. Organizations relying on IBM i host servers for business-critical operations (such as database, file, or application serving) could experience significant service disruption (GitHub Advisory, IBM Support).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.39% (32nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment notes the attack is automatable but exploitation has not been observed.

IBM has released a patch addressing this vulnerability, available as of August 13, 2026, via the IBM support page. Administrators should apply the relevant PTF (Program Temporary Fix) for their IBM i version (7.3, 7.4, 7.5, or 7.6) as documented in the IBM support advisory. As an interim measure, organizations should consider implementing network-level controls (e.g., firewalls, access control lists) to restrict access to IBM i host server ports from untrusted or external networks, and monitor for abnormal traffic patterns or unexpected server crashes (IBM Support).