EUVD-2026-67948
GHSA-6rjg-22x4-mfvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged account on AIX/VIOS
-
DeliveryIdentify privileged binary with format string flaw
-
ExploitSupply malicious format specifiers as input
-
ExecutionCorrupt memory (overwrite return address/function pointer)
-
PersistRedirect execution to controlled payload
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Format string safety
|
| Exploitation Conditions | Exploitation requires an existing local account on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system - remote unauthenticated exploitation is not possible (AV:L, PR:L). The attacker must be able to execute code or pass controlled input to a privileged process or setuid binary that contains the vulnerable format string call. No non-default configuration or specific feature enablement is described as required; the vulnerability appears to exist in a core component of the base OS or VIOS. Exploitation is limited to systems running AIX 7.2, 7.3, or VIOS 4.1 on POWER hardware; other operating systems or hypervisors are unaffected. |
| Impact | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local, low-complexity exploitation requiring only an existing unprivileged account - no user interaction or special configuration needed. Despite the 'total' SSVC technical impact, real-world urgency is significantly moderated: EPSS is 0.10% (1st percentile), no public exploit code exists, CISA KEV does not list this CVE, and SSVC exploitation status is 'none'. This is a classic high-CVSS-but-low-active-risk finding - meaningful for environments with untrusted local users (shared AIX partitions, VIOS management planes with multi-tenant access) but not an emergency for systems with strictly controlled local access. The VIOS exposure warrants attention in hypervisor contexts where a compromised VIOS account could affect guest LPARs. No CVSS/description conflict detected; all signals are internally consistent. |
| Exploit ScenarioDerived | A local user with a standard unprivileged account on an IBM AIX 7.3 or VIOS 4.1 system crafts input that injects format specifiers (e.g., %n, %x) into a privileged process or setuid binary that passes the input unsanitized to a format-string function, overwriting a return address or function pointer. Execution is redirected to attacker-controlled shellcode or a ROP chain, yielding a root shell. No public exploit code has been identified at time of analysis, but format string primitives on known vulnerable platforms are well-understood in the offensive research community. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 02, 2026
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exploits a format string vulnerability (CWE-134) to allow a low-privileged local attacker to gain elevated - potentially root-level - privileges with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.10% (1st percentile), consistent with an SSVC exploitation status of 'none'. IBM has released a patch at the advisory linked below.
Earlier versions of this analysis (1)
Local privilege escalation in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 stems from a format string vulnerability (CWE-134), enabling a low-privileged local attacker to achieve full system compromise - high confidentiality, integrity, and availability impact consistent with root-level access. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires existing local access and elevated attack complexity, limiting opportunistic exploitation. No public exploit identified at time of analysis, and no CISA KEV listing; a vendor patch is available via IBM support advisory.
RemediationAI
Apply the IBM-supplied patch documented at https://www.ibm.com/support/pages/node/7283858 - this is the primary and recommended fix; an exact patched build version should be confirmed from that advisory page, as the input data confirms patch availability without specifying the exact fix version number. For VIOS 4.1 environments, prioritize patching the VIOS partition first, as privilege escalation there can affect guest LPAR isolation. As a compensating control prior to patching, restrict local shell access to the AIX/VIOS system to only explicitly authorized administrative accounts, and audit for any unnecessary setuid binaries or privileged daemons exposing format-string-vulnerable code paths. Note that restricting local logins may impact legitimate administrators and should be coordinated with operational teams.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-134 (Use of Externally-Controlled Format String) arises when attacker-supplied data is passed directly as the format argument to functions like printf(), syslog(), or snprintf(). On IBM AIX - a UNIX-derived operating system for POWER hardware - binaries running with elevated privileges (setuid, kernel-owned processes, or privileged daemons) are the typical attack surface for local privilege escalation via this class of flaw. The affected CPEs cpe:2.3:a:ibm:aix:* (covering 7.2 and 7.3) and cpe:2.3:a:ibm:powervm_vios:* (covering VIOS 4.1) confirm the issue spans both the base OS and the Virtual I/O Server management layer. VIOS 4.1 runs as a partition on POWER systems and controls virtualized storage and networking for guest LPARs, making privilege escalation there potentially more impactful than on a standalone AIX system.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack surface (AV:L) with low-privilege account required (PR:L); format string exploitation is straightforward (AC:L) with full system compromise upon success.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability.
Executive ViewAI
IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 contain a local privilege escalation vulnerability that allows low-privileged users to gain root-level access and full system control. Organizations running these enterprise Unix systems should prioritize patching to mitigate insider threats and prevent unauthorized elevation of privileges that could lead to data compromise or operational sabotage.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB