EUVD-2026-62527
GHSA-72jw-xc98-wq8x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated trigger with no interaction; pure crash impact with no confidentiality or integrity consequence, consistent with DoS-only NULL pointer dereference.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.
AnalysisAI
IBM AIX 7.2 and 7.3, and PowerVM VIOS 4.1 expose an unauthenticated remote denial-of-service condition rooted in a NULL pointer dereference. A remote attacker with no credentials or user interaction can crash affected network-accessible components, resulting in complete availability loss (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis, and IBM has released a patch via advisory https://www.ibm.com/support/pages/node/7283858.
Technical ContextAI
CWE-476 (NULL Pointer Dereference) describes a class of defects where code attempts to read or write through a pointer that holds a null value, causing an unhandled exception and typically a process crash or kernel panic. IBM AIX is a proprietary Unix-based operating system designed for IBM POWER architecture hardware, and PowerVM VIOS (Virtual I/O Server) is the virtualization layer that manages physical I/O resources and presents them to logical partitions (LPARs) in IBM PowerVM environments. The CPE strings cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:* use wildcards across all sub-versions, indicating the vulnerability is present across a broad range of releases within AIX 7.2/7.3 and VIOS 4.1 without a more precise version boundary established in NVD data. The specific network-facing component or protocol triggering the dereference is not identified in available data.
RemediationAI
IBM has released a patch addressing this vulnerability; organizations should consult the IBM Security Advisory at https://www.ibm.com/support/pages/node/7283858 to obtain the applicable fix pack, interim fix, or Technology Level update for IBM AIX 7.2/7.3 or PowerVM VIOS 4.1. The exact fixed version numbers are not independently confirmed from available data and must be verified in the advisory before deployment. As a compensating control prior to patching, restrict network access to AIX and VIOS management interfaces using host-based firewalls (ipfilter on AIX) or network segmentation to permit connections only from trusted administration networks, reducing the attack surface for remote unauthenticated exploitation. Note that restricting network access is effective only if the vulnerable component is among those accessible via filtered ports - since the specific service is unknown, broad network restriction is preferable until the advisory clarifies the affected component.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today