IBM i versions 7.3 through 7.6 contain a vulnerability where improper validation of the LANG environment variable can lead to privilege escalation by a local attacker. This vulnerability is identified as CWE-73 (External Control of File Name or Path) and has a CVSS 3.1 base score of 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability allows an attacker with local access and low complexity to escalate privileges without user interaction. No vendor advisory or patch information is currently provided.

A local attacker with low complexity can exploit this vulnerability to gain elevated privileges on affected IBM i systems, potentially leading to full system compromise. The CVSS score indicates high impact on confidentiality, integrity, and availability, meaning sensitive data could be exposed, modified, or destroyed, and system operations disrupted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for unusual privilege escalation attempts.