Heap-based buffer overflow in GStreamer's MRF file parser enables remote code execution when a user opens a crafted media file or visits a page that triggers parsing. The root cause is absent length validation before copying attacker-supplied data into a heap buffer (CWE-122), granting full confidentiality, integrity, and availability impact within the target process. Reported by ZDI as ZDI-CAN-29608 and addressed in GStreamer security advisory SA-2026-0050; no public exploit code or CISA KEV listing is confirmed at time of analysis.
Heap-based buffer overflow in GStreamer's PNG file parsing allows remote code execution in the context of the affected process. Affects GStreamer installations where a user can be induced to open or process a maliciously crafted PNG file - via a web page or file download. The flaw stems from missing length validation before copying attacker-controlled data into a heap buffer (CWE-122). No public exploit or CISA KEV listing is identified at time of analysis; however, ZDI disclosed the issue under ZDI-26-466 following coordinated disclosure, and GStreamer has issued security advisory sa-2026-0052.
Stack-based buffer overflow in GStreamer's OGG file parsing component allows remote attackers to execute arbitrary code in the context of the current process. Affected installations of GStreamer fail to validate the length of user-supplied data before copying it to a stack-based buffer during OGG container parsing, enabling full code execution (C:H/I:H/A:H). No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, though it was discovered and disclosed by the Zero Day Initiative (ZDI-CAN-29584), which typically indicates a reliable, well-researched finding.
Remote code execution is possible in OriginLab Origin Viewer through a memory corruption flaw triggered during OGW file parsing. An attacker can exploit this by enticing a target user to open a maliciously crafted OGW file or visit a page that delivers one, executing arbitrary code in the context of the current user process. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29338), indicating structured third-party research.
Remote code execution in GStreamer's rtpsbcdepay plugin is achieved when a user processes a crafted RTP stream containing malformed SBC audio payload, triggering a use-after-free that corrupts heap memory and redirects execution to attacker-controlled code within the affected process. The flaw exists in all GStreamer installations where the rtpsbcdepay element is exercised, covering a broad surface area including Linux media players, VoIP clients, and Bluetooth audio gateways. No public exploit has been identified at time of analysis, but coordinated disclosure by ZDI (ZDI-CAN-29787) confirms technical reproduction, and a vendor security advisory (SA-2026-0051) has been published.
Remote code execution via malicious MRF media files affects GStreamer across all versions tracked under CPE cpe:2.3:a:gstreamer:gstreamer:*:*:*:*:*:*:*:*. The MRF file parser fails to validate user-supplied input bounds, allowing a heap out-of-bounds write (CWE-787) that corrupts memory and redirects execution to attacker-controlled code within the victim process. Exploitation requires user interaction - opening a crafted file or visiting a page that triggers GStreamer parsing - and no public exploit or CISA KEV listing has been identified at time of analysis, though ZDI coordinated disclosure (ZDI-CAN-29510) and an upstream vendor advisory (sa-2026-0050) are both present.
Remote code execution in OriginLab Origin Viewer 9.9.5 is achievable by tricking a user into opening a specially crafted OPJ project file, triggering an out-of-bounds write in the file parser that corrupts memory and redirects execution to attacker-controlled code. The vulnerability was discovered and reported by Zero Day Initiative (ZDI-CAN-29336) and carries a CVSS 7.8 score with full confidentiality, integrity, and availability impact scoped to the user process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in OriginLab OriginPro allows attackers to execute arbitrary code within the victim's process context by supplying a crafted OGG file. The root cause is a CWE-119 memory corruption condition in the OGG file parser, where user-supplied data is not properly validated before use, enabling a buffer overflow. Exploitation requires user interaction - the victim must open a malicious file or visit a page that triggers OriginPro's parser - and no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in OriginLab OriginPro 2026 SR1 is triggered when a victim opens a specially crafted OGW workspace file, exploiting a memory corruption flaw in the file parser. The vulnerability, reported by Zero Day Initiative (ZDI-26-550/ZDI-CAN-29334), allows an attacker to execute arbitrary code in the context of the current user process without requiring any privileges on the target system. No active exploitation has been confirmed in CISA KEV at time of analysis, and EPSS data was not provided, but the ZDI public advisory and vendor CVE page are both live.
Out-of-bounds write in OriginPro's OGG file parsing component enables arbitrary code execution in the context of the current user's process when a crafted OGG file is opened. Affected installations include OriginPro 2026 SR1, as confirmed by ZDI (ZDI-CAN-29333 / ZDI-26-549) and EUVD-2026-63438. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis, though user interaction is the sole barrier to exploitation once a malicious file is delivered.
Out-of-bounds write in OriginPro's OPJ project file parser enables remote attackers to execute arbitrary code when a user opens a specially crafted OPJ file. The flaw, disclosed by Zero Day Initiative as ZDI-CAN-29332, results from insufficient validation of user-supplied data during file parsing - allowing a write past the end of an allocated data structure and full compromise of the target process. No public exploit code and no active exploitation (CISA KEV) has been identified at time of analysis, but ZDI coordinated disclosure typically reduces the time-to-exploit development once advisories publish.
Remote code execution is achievable in OriginLab OriginPro through a maliciously crafted OPJU project file, exploiting an out-of-bounds write (CWE-787) in the application's file parser. OriginPro 2026 SR1 is confirmed affected per EUVD-2026-63436, with the CPE string suggesting broader version coverage may apply. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; however, ZDI discovery (ZDI-CAN-29331) indicates coordinated research disclosure, and the low attack complexity once the file is delivered makes this a meaningful risk to research and scientific computing environments.
Stack buffer overflow in GNU binutils 2.46.1 and earlier allows arbitrary code execution when a victim opens a crafted PE (Portable Executable) file using any binutils tool such as objdump or readelf. The out-of-bounds stack write (CWE-787) can corrupt return addresses, enabling attacker-controlled code execution in the victim's user context. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 7.8 High rating reflects full confidentiality, integrity, and availability impact if successfully exploited.
Arbitrary command execution on IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 is achievable by a local attacker through improper privilege management (CWE-269), yielding full confidentiality, integrity, and availability compromise of the affected system. The vulnerability carries a CVSS 7.8 HIGH score with a local attack vector, no prior privileges required, and a user interaction dependency. No public exploit code has been identified at time of analysis; a vendor-released patch is available via IBM's support advisory.
Arbitrary code execution on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a CWE-822 untrusted pointer dereference, where a locally authenticated, low-privilege attacker can supply a crafted pointer value that the OS or VIOS component fails to validate before dereferencing. Successful exploitation yields full confidentiality, integrity, and availability compromise of the affected system (CVSS 7.8 High, C:H/I:H/A:H). No public exploit or CISA KEV listing exists at time of analysis; SSVC rates exploitation status as none and the attack as non-automatable.
Symlink following in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a local low-privileged attacker to overwrite arbitrary files on the system, including those owned by root. The flaw stems from improper resolution of symbolic links (CWE-59) during privileged file operations, enabling integrity and availability impacts equivalent to a high-severity local privilege escalation primitive. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the CVSS 7.8 High rating reflects the significant impact of arbitrary file overwrite on a privileged OS.
Local privilege escalation and denial of service in libvirt's NodeGetFreePages RPC handler allows an unprivileged local user to corrupt the root libvirtd daemon's heap memory through a crafted integer overflow. The CWE-190 flaw causes an undersized buffer allocation that is subsequently overwritten with real NUMA node data, enabling heap buffer overflow in a root-owned process. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 7.8 score (AV:L/AC:L/PR:L) and full C/I/A impact make this a genuine priority on multi-tenant RHEL virtualization hosts.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full confidentiality, integrity, and availability compromise of the affected system. The CVSS score of 7.8 reflects the high post-exploitation impact despite the local attack vector requirement. No public exploit has been identified at time of analysis, and SSVC confirms no known exploitation activity, though the vendor has released a patch.
Heap-based buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables a local, low-privileged attacker to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability stems from unsafe memory writes (CWE-787) that corrupt heap structures at runtime. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via the advisory at ibm.com/support/pages/node/7283858.
Privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a local low-privileged attacker to gain elevated system access by exploiting improper symbolic link resolution (CWE-59). The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact on successful exploitation, though the local attack vector (AV:L) and low EPSS of 0.17% (7th percentile) substantially constrain real-world risk. No public exploit or active exploitation has been identified at time of analysis, and IBM has released a patch via its support portal.
Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated privileges by exploiting an out-of-bounds write (CWE-787) memory corruption flaw. The vulnerability affects IBM's enterprise Unix operating system and its virtualization platform, with full confidentiality, integrity, and availability impact confirmed by the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, and EPSS rates the exploitation probability at just 0.17% (6th percentile), consistent with the SSVC assessment of exploitation status as none.
Local arbitrary code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from an out-of-bounds read (CWE-125) exploitable by a low-privileged local user with no user interaction required. A successful attacker achieves full confidentiality, integrity, and availability compromise of the affected system, as reflected in the CVSS 3.1 score of 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity makes this a credible local privilege escalation path on POWER-architecture infrastructure.
Stack-based buffer overflow in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 enables a local low-privileged attacker to execute arbitrary code, achieving full system compromise (C:H/I:H/A:H). The attack requires only a local account with standard user privileges and no user interaction, making post-authentication lateral movement or privilege escalation a realistic threat in IBM Power-based enterprise environments. No public exploit identified at time of analysis, but a vendor-released patch is available.
Local privilege escalation in Parallels RAS Client 21.0.26296 allows an attacker holding low-privileged code execution to reach SYSTEM-level authority by invoking an exposed dangerous function in the RAS RDP Backend Service (CWE-749). The CVSS 7.8 (High) rating reflects full confidentiality, integrity, and availability impact once exploited, with low attack complexity and no user interaction required beyond an initial foothold. No public exploit code and no CISA KEV confirmation have been identified at time of analysis, though ZDI's coordinated disclosure (ZDI-26-556) may accelerate POC development.
Local privilege escalation in Parallels RAS Client 21.0.26296 allows low-privileged local attackers to gain SYSTEM-level code execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The root cause is CWE-749, where a privileged service function is accessible without proper access control to lower-privileged callers. Discovered and reported by Zero Day Initiative (ZDI-26-555 / ZDI-CAN-28885), no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Parallels RAS Client 21.0.26296 allows a low-privileged local attacker to escalate to SYSTEM-level execution by invoking an exposed dangerous function within the RAS RDP Backend Service. The flaw (CWE-749) stems from the service exposing an unsafe method that can be abused without administrative rights, enabling full system compromise. No public exploit or CISA KEV listing has been identified at time of analysis, though the vulnerability was coordinated through Zero Day Initiative (ZDI-CAN-29220).
Kernel-stack out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local attacker with low-privilege shell access to corrupt kernel memory by causing the kernel to parse a crafted filesystem image during directory reads. Successful exploitation can crash the system or escalate privileges to root, yielding full system compromise. No public exploit code has been identified and EPSS remains very low at 0.16% (6th percentile), though SSVC rates technical impact as total, reflecting the severity of a successful local privilege escalation on IBM Power infrastructure.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 via heap buffer overflow (CWE-787) enables an authenticated local attacker with standard user-level access to gain elevated - potentially root - privileges on affected systems. The CVSS 7.8 High score reflects full confidentiality, integrity, and availability impact despite the local attack vector, making this a serious insider-threat and post-compromise escalation risk. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Kenwood DNR1007XR network video recorder enables an attacker with existing low-privileged code execution to gain root-level access by exploiting incorrectly permissioned resources associated with the udhcpd DHCP service. Discovered by Zero Day Initiative and tracked as ZDI-CAN-29111/ZDI-26-487, the flaw stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), granting full C:H/I:H/A:H impact once the prerequisite foothold is established. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables any low-privileged authenticated user to achieve full system compromise through improper symbolic link handling. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms complete confidentiality, integrity, and availability impact with no user interaction required. No public exploit identified at time of analysis; a vendor patch has been released via IBM advisory https://www.ibm.com/support/pages/node/7283858.
Local privilege escalation in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a low-privileged local user to gain elevated-likely root-level-access through improper privilege management (CWE-269). The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though IBM has released a patch via their support portal.
Privilege escalation in Ubuntu's accountsservice package allows a local low-privileged user to execute arbitrary shell commands as root (real UID 0) by injecting a GNU sed 'e' flag payload into their ~/.pam_environment LANGUAGE entry, which is then processed unsanitized by Ubuntu-specific helper scripts (save-to-pam-env, update-langlist) when the SetLanguage D-Bus method is invoked. All Ubuntu accountsservice packages before version 23.13.9-8ubuntu7 are affected; this is a Ubuntu-specific packaging defect, not an upstream accountsservice issue. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack path is well-described and technically straightforward.
Privilege escalation on IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows any low-privileged local user to gain full system control by exploiting improper authorization checks (CWE-285). SSVC rates the technical impact as total, consistent with the CVSS C:H/I:H/A:H rating, meaning a successful attacker achieves complete compromise of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects negligible current exploitation pressure, though the low attack complexity makes this a meaningful insider-threat or post-compromise escalation risk.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows an authenticated local attacker with low-level access to gain elevated (likely root) privileges due to improper privilege management (CWE-269). The CVSS score of 7.8 reflects total confidentiality, integrity, and availability impact upon successful exploitation. No public exploit has been identified at time of analysis, EPSS is extremely low at 0.11% (2nd percentile), and SSVC confirms no observed exploitation, though technical impact is rated total if the flaw is triggered.
Use-after-free in libexpat before 2.8.4 enables a local low-privileged attacker to corrupt parser memory and potentially achieve arbitrary code execution by supplying a crafted XML document with custom encoding callbacks. The flaw stems from the unknown encoding callback path (convert/release handlers) bypassing the reentrancy depth-tracking guards applied to all other libexpat callbacks, allowing an attacker-controlled callback to re-enter the parser and corrupt its state. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.10% (1st percentile), though this belongs to a confirmed series of related reentrancy fixes in libexpat (CVE-2026-50219, CVE-2026-56131, CVE-2026-56412) and Red Hat has already shipped a backported errata.
Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. Any shell spawned by a helper script can call setuid(0) to restore root effective privileges, granting complete system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SSRF in langchain-community's SitemapLoader defeats the documented `restrict_to_same_domain` security control by failing to apply it to nested sitemap index entries, allowing an attacker who influences an ingested sitemap to exfiltrate responses from internal network resources including loopback, link-local, and RFC-1918 addresses. Any LangChain-based pipeline consuming attacker-influenced sitemaps is affected; the CVSS 4.0 score of 7.7 reflects high confidentiality impact on downstream internal systems (SC:H) with no authentication or complexity requirements. No public exploit code has been confirmed and the flaw is not listed in CISA KEV at time of analysis, though the attack path is directly derivable from the vulnerability description.
Remote denial-of-service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows an unauthenticated network attacker to crash affected systems by sending a crafted UDP packet to the RPC service. The attack requires no credentials or user interaction and results in complete system unavailability, demanding an LPAR restart to recover - a non-trivial operational impact for enterprise environments running critical POWER-based workloads. No public exploit code has been identified at time of analysis, but the trivially low attack complexity against a zero-authentication network service elevates practical risk.
Server-Side Request Forgery in PTC Windchill PDMLink and PTC FlexPLM allows unauthenticated remote attackers to induce the server to issue arbitrary internal network requests by submitting maliciously crafted serialized data for deserialization. The underlying root cause is CWE-502 (Deserialization of Untrusted Data), where the deserialization process itself is the vector that triggers the SSRF condition, enabling lateral movement toward backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of network accessibility and no authentication requirement elevates practical risk for internet-exposed deployments.
Code execution in n8n's Git node (all 1.x releases before 1.123.69, all 2.x releases before 2.33.4 and 2.34.1) allows an authenticated attacker who can also plant files on the n8n host to run arbitrary OS commands as the n8n process user. The Git node passes repository-local git configuration values directly to execution without neutralization, satisfying CWE-78 (OS Command Injection); triggering any Git node operation against a repository whose config has been poisoned fires the injected command automatically. No public exploit has been identified at time of analysis, but the high impact triad (VC:H/VI:H/VA:H) and confirmed patch availability make immediate upgrading the correct response.
Credential exfiltration in RHACM's multicloud-operators-subscription component allows an authenticated tenant with HelmRelease create permissions to bypass Kubernetes namespace isolation by manipulating the `secretRef.Namespace` field, causing the HelmRelease controller to fetch Secrets from arbitrary namespaces and transmit them to an attacker-controlled Helm repository. The CVSS S:C (scope changed) metric confirms this breaks the namespace boundary that Kubernetes multi-tenancy depends on, enabling low-privileged lateral movement across namespace security domains. No public exploit or CISA KEV active exploitation listing is confirmed at time of analysis; however, the attack is mechanically straightforward for any cluster account holding the requisite RBAC permission.
Authentication bypass and token replay in node-opcua's UserNameIdentityToken handler enables unauthenticated remote attackers to authenticate as any user whose account accepts an empty password, and to replay captured session tokens unconditionally across unrelated sessions. Versions up to and including 2.165.0 of the npm package are affected. The vulnerability is compounded when SecurityMode=None is configured, which causes the channel-level signature verification to return true unconditionally. A proof-of-concept attack sequence has been dynamically confirmed by the reporter; no vendor-released patch has been identified at time of analysis.
NoSQL operator injection in LangGraph's MongoDB persistence libraries (langgraph-checkpoint-mongodb < 0.3.0 and langgraph-store-mongodb < 0.4.0) allows authenticated API callers to embed MongoDB query operators directly in filter parameters, bypassing per-tenant query predicates and exposing other tenants' checkpoint and store data. The flaw affects MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() methods whenever filter arguments derive from user-controlled input in multi-tenant deployments. No public exploit or CISA KEV listing exists at time of analysis, but the cross-tenant data exposure is a concrete, high-impact risk for any multi-tenant LangGraph AI agent application backed by MongoDB.
Server-side request forgery in Microsoft Azure Data Factory exposes sensitive internal information to unauthenticated remote attackers over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network positioning - any internet-reachable instance is in scope. No active exploitation has been confirmed by CISA KEV or public POC at time of analysis; SSVC rates exploitation as 'none' and EPSS at 0.99%, indicating limited real-world uptake despite the high CVSS base score.
SQL injection in Fleet's Okta conditional access integration allows an attacker controlling any single enrolled host to read or modify arbitrary Fleet database contents, including stored session tokens. Disclosed tokens can be replayed to impersonate a global administrator, enabling remote code execution on all managed hosts. The CVSS 4.0 score of 7.6 (AT:P) reflects that exploitation requires Fleet Premium with the Okta conditional access feature enabled, but within that deployment profile the impact chain extends to full fleet compromise. No public exploit identified at time of analysis; vendor-released patch is available as fleet-v4.86.2.
Blind SQL Injection in the InfiniteWP Client WordPress plugin (revmakx) through version 1.13.9 allows high-privileged authenticated attackers to exfiltrate database contents via crafted network requests. The scope-changed CVSS vector (S:C/C:H) indicates the injection reaches beyond the WordPress application boundary into the underlying database layer, enabling extraction of sensitive stored data including credentials and application records. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though Patchstack's disclosure confirms it is reproducible.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 is reachable by unauthenticated remote attackers through improper validation of an allocation size, crashing the affected system or service without any user interaction. The vulnerability carries a CVSS 7.5 High score driven entirely by a complete availability impact against a network-accessible, zero-prerequisite attack path. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote denial of service in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker via a NULL pointer dereference (CWE-476) in a network-accessible component, yielding full availability loss against affected systems. The vulnerability carries a CVSS 7.5 High score with no confidentiality or integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker to crash affected systems by supplying a crafted request that exploits improper validation of an array size field. The CVSS 7.5 (High) score reflects a fully network-exploitable, zero-complexity, no-privilege-required attack path targeting availability exclusively. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting this has not yet been weaponized at scale.