CVE-2026-18341: Medium Integer Underflow in IBM i 7.3 to 7.6

CVE-2026-18341 is a medium severity (CVSS 6.3) integer underflow in IBM i 7.3, 7.4, 7.5 and 7.6 that lets a remote authenticated attacker corrupt memory. IBM fixes it with PTFs MJ11326 (7.6), MJ11327 (7.5), MJ11328 (7.4) and MJ11329 (7.3) for product 5770-999.

What's affected

IBM's bulletin lists IBM i 7.3, 7.4, 7.5 and 7.6 as affected and gives these PTFs for product 5770-999:

• 7.6: MJ11326
• 7.5: MJ11327
• 7.4: MJ11328
• 7.3: MJ11329

IBM lists no mitigations or workarounds and tells owners of unsupported versions to move to a supported, fixed release. IBM's own score is 6.3 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, the same as the record. The record also lists CWE-122 (heap based buffer overflow) alongside the integer underflow.

How to check if you're exposed

Check whether the PTF for your release is installed on every IBM i partition:

DSPPTF LICPGM(5770999) SELECT(MJ11326)

Use the PTF number that matches your release. A status of applied means you have the fix. IBM Fix Central and the bulletin remain the authoritative source if the display differs.

Also confirm the release level of each partition, since a system on an unsupported release will not receive a PTF at all.

What to do now

1. List all IBM i partitions and their release levels.
2. Order the PTF for each release from IBM Fix Central.
3. Apply the PTFs and perform any IPL that the cover letter requires.
4. Move any system on an unsupported release to a supported one.
5. Restrict remote access to IBM i services to the networks that need it.

Why it matters

The weakness classes are CWE-191 (integer underflow) and CWE-122 (heap based buffer overflow). An integer underflow happens when arithmetic produces a value below the lowest number a type can hold, which wraps to a large value. If that number is then used as a size or an offset, memory outside the intended region can be read or written.

Memory corruption on a system component can lead to crashes or, in the worst case, changes to behavior that the attacker did not have rights to make. Here the rating is moderate because the attacker must be signed in and the impacts are low in each category. KEV status is false. Treat it as ordinary maintenance rather than an emergency, but do not leave it open.

Quick check

Sources

• IBM security bulletin 7286094

Last reviewed: 18 October 2026.