CVE-2026-17470: Medium LPD Buffer Overflow in IBM i

CVE-2026-17470 is a buffer overflow in the Line Printer Daemon (LPD) of IBM i 7.6, 7.5, 7.4 and 7.3 that lets a remote attacker cause a denial of service. It scores 5.3, Medium. IBM's fix is PTF SJ11300, SJ11301, SJ11302 or SJ11303 for licensed program 5770-TC1, by release.

What's affected

IBM i 7.3, 7.4, 7.5 and 7.6, licensed program 5770-TC1, where LPD lives. IBM's bulletin from 1 September 2026 lists:

• 7.6: SJ11300
• 7.5: SJ11301
• 7.4: SJ11302
• 7.3: SJ11303

The same bulletin covers a second LPD issue, CVE-2026-17469, an off-by-one write in the queue name parser, rated 5.3 as well. IBM lists no workaround.

The record scores it 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The vector is network, low complexity, no privileges, with low availability impact and nothing else. IBM's bulletin gives the same score.

How to check if you're exposed

IBM i exposure comes down to release and PTF level. First confirm which release you run (option 10 of GO LICPGM lists installed licensed programs and their releases). Then check whether the fixing PTF for your release is loaded and applied.

DSPPTF LICPGM(5770TC1) SELECT(SJ11300)

Swap in the PTF number for your release from the table above. If the command reports the PTF as not found, you do not have the fix. Run the command without the SELECT parameter to list every PTF for that product. If a PTF shows as loaded but not applied, finish it through your normal PTF process before you count it as done.

To see whether LPD is even running, look for the LPD server job on the partition. A service that is not started cannot be reached, though the code still needs patching.

What to do now

1. Find partitions where the LPD server is started, and who can reach TCP port 515 on them.
2. If nothing needs LPD, end the server and prevent it starting automatically, and still schedule the PTF.
3. Apply the PTF for your release: SJ11300, SJ11301, SJ11302 or SJ11303.
4. Cover the sibling CVE-2026-17469 in the same change; the PTFs in the bulletin address both LPD issues.
5. IBM lists no workaround for this bulletin, and recommends that anyone on an unsupported release move to a supported and fixed version.

Why it matters

The record classes the weakness as CWE-787, Out-of-bounds Write. LPD is an old print protocol, and old network daemons have a long history of memory handling bugs. A buffer overflow here means the daemon copies data it received into a buffer that is too small. IBM says the result is a denial of service, and the vector rates the availability impact as low, probably because the damage is limited to the print service rather than the whole system.

That limited rating is why this lands in the Medium band. It is still worth the change for two reasons. First, there is no authentication in the vector, so reach is the only barrier. Second, a print daemon exposed to wide networks has little reason to be there.

If your estate has moved printing to other mechanisms, ending the LPD server is a cleaner outcome than patching a service you do not use. Where you do use it, keep it to trusted print clients. The record does not report exploitation and CISA does not list the CVE.

Quick check

Sources

• IBM Security Bulletin 7285939: IBM i LPD, fetched 18 October 2026

Last reviewed: 18 October 2026.