CVE-2026-18511 is a high severity (CVSS 7.3) stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session setup. It can crash the JVM or allow code execution. IBM fixes it with 5770-JV1 PTFs for IBM i 7.3 through 7.6.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6 are affected. The bulletin lists these PTFs for product 5770-JV1:
- 7.6: SJ11036, SJ11072, SJ11082, SJ11088
- 7.5: SJ11068, SJ11073, SJ11070, SJ11077, SJ11087
- 7.4: SJ11071, SJ11069, SJ11076, SJ11086
- 7.3: SJ11067, SJ11075, SJ11085
The bulletin also covers three other CVEs and does not map each PTF to one CVE, so apply the full set for your release. IBM lists no workaround. The sources differ on attack vector: the NVD text says a local authenticated attacker, while the CVSS vector uses a network vector with no privileges required. IBM's score is 7.3, the same as the record.
How to check if you're exposed
Check each PTF for your release on every partition that runs Java:
DSPPTF LICPGM(5770JV1) SELECT(SJ11036)
Repeat for each PTF number. Also find which applications use the native JSSE provider for TLS, since those are the processes that parse the handshake. Your Java application owners can tell you which security provider each JVM uses.
What to do now
- List the partitions that run Java on IBM i, and their releases.
- Apply all 5770-JV1 PTFs listed for your release.
- Restart Java applications after the PTFs are applied.
- Confirm which TLS provider each critical application uses.
- Monitor JVM crashes and restarts, which could indicate probing.
Why it matters
The weakness class is CWE-787, an out-of-bounds write. During session setup, the code copies handshake data into a fixed size buffer on the stack without checking length. A longer value than expected writes past the end of the buffer and can corrupt the stack, which at minimum crashes the JVM and in the worst case redirects execution.
TLS code is a sensitive place for this kind of bug, because it processes bytes from the other side before authentication is complete. The record shows no exploitation and the KEV flag is false, but because the vector in the record needs no privileges, apply the PTFs on a normal patch cycle with some priority.
Quick check
Do I need all the listed PTFs?
IBM does not map PTFs to single CVEs and the bulletin covers several, so apply the full list for your release.
What does a crash look like?
A JVM that exits or restarts during a TLS handshake. Check your application logs and job logs.
Sources
Last reviewed: 18 October 2026.
