EUVD-2026-62713
GHSA-q92g-g9q5-r575
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no auth, but AC:H reflects the specific conditions needed to trigger the uninitialized pointer; impact is availability-only with no scope change.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.
AnalysisAI
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 can be triggered by a remote, unauthenticated attacker exploiting an uninitialized stack pointer (CWE-908), leading to system unavailability. The CVSS vector scores high attack complexity (AC:H), indicating that successful exploitation requires specific conditions or timing rather than a straightforward network request. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
CWE-908 (Use of Uninitialized Resource) describes a condition where program logic references a stack pointer before it has been assigned a valid value. On IBM AIX - a UNIX-based operating system for IBM Power Systems hardware - and PowerVM VIOS (Virtual I/O Server, the hypervisor management layer on IBM Power), an uninitialized stack pointer can be dereferenced when specific network traffic triggers the vulnerable code path, causing a kernel-level crash or uncontrolled fault that results in a denial of service. CPE strings (cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*) indicate the flaw spans broad version ranges of both products within the affected major releases. IBM Power Systems environments are common in financial services, telecommunications, and large enterprise workloads, meaning VIOS disruption could cascade to hosted LPARs (Logical Partitions).
RemediationAI
IBM has released a patch addressing this vulnerability, available via the IBM support portal at https://www.ibm.com/support/pages/node/7283858. Administrators should consult this advisory to obtain the specific fix level (iFix or Technology Level) applicable to their AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1 installation. An exact patched version number was not independently confirmed from the available data - refer directly to the IBM bulletin for authoritative fix identification. As a compensating control prior to patching, network-level controls such as firewall rules or ACLs restricting access to the vulnerable network service to trusted hosts can reduce exposure; the trade-off is potential disruption to legitimate administrative or inter-system communication. For PowerVM VIOS environments, prioritize patching during a planned maintenance window, as a VIOS outage can impact all hosted LPARs.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today