CVE-2026-18511 is a stack-based buffer overflow vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 within the Native IBM i JSSE provider. The issue arises from improper bounds checking during TLS session establishment, enabling a local authenticated attacker to overflow a fixed-length buffer. Successful exploitation could allow arbitrary code execution on the system or cause the JVM process to crash. The vulnerability is classified under CWE-787 and has a CVSS 3.1 base score of 7.3, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

A local authenticated attacker can exploit this vulnerability to execute arbitrary code on the affected IBM i system or cause the JVM process to crash, potentially leading to denial of service or unauthorized control over the system. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to the Native IBM i JSSE provider. Avoid exposing vulnerable IBM i systems to untrusted local users.