Executive brief
IBM i is an enterprise operating system used to run business-critical applications and databases on IBM Power Systems. A race condition vulnerability in the SQL Query Engine allows a local attacker with login access to take ownership of arbitrary files on the system, potentially enabling privilege escalation or compromise of sensitive data and system configurations.
Technical details
The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) in IBM i's SQL Query Engine that allows a local, authenticated attacker to obtain ownership of arbitrary file system objects. The race condition occurs between the moment the system checks permissions on a file and the moment it performs an operation on that file, during which an attacker can manipulate the file system. An attacker with local login privileges can exploit this window to gain ownership of files they should not have access to. IBM has released PTFs (Program Temporary Fixes) for versions 7.3, 7.4, 7.5, and 7.6 to address this vulnerability.
Affected products
- IBM i 7.3, 7.4, 7.5, 7.6
Timeline
- 2026-09-14: disclosed