EUVD-2026-62722
GHSA-cpmx-x7w2-qmhv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states denial of service only, so C:N/I:N with A:H; network-reachable, unauthenticated, low-complexity per the stated vector gives AV:N/AC:L/PR:N/UI:N.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an integer underflow.
AnalysisAI
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker crash or hang the affected system by triggering an integer underflow (CWE-190) in a network-reachable component. The flaw was reported by IBM, which has released a fix; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Note that IBM's published CVSS 9.8 claims full confidentiality/integrity/availability impact, which conflicts with the description's DoS-only wording.
Technical ContextAI
IBM AIX is IBM's proprietary Unix operating system for POWER-architecture servers, and PowerVM VIOS (Virtual I/O Server) is the AIX-based appliance that virtualizes storage and network I/O for LPARs on those systems, so VIOS being affected alongside AIX suggests the defect lives in shared OS-level code reachable over the network. The root cause is classified as CWE-190 (integer overflow/wraparound); the description specifically cites an integer underflow, where a subtraction drives an unsigned value below zero and wraps to a very large number, typically corrupting a length or size calculation and leading to out-of-bounds access or resource miscalculation that aborts the process or kernel path. The affected CPEs are cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios, with all listed versions (AIX 7.2, AIX 7.3, VIOS 4.1) marked vulnerable.
RemediationAI
Patch available per vendor advisory: apply the fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7283858, which corresponds to the appropriate iFix/APAR or Technology Level/Service Pack for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 (the exact patched build numbers are not enumerated in the provided data and should be read directly from that page). Until the fix is applied, reduce exposure by restricting network reachability of the affected service - place AIX and VIOS management/service interfaces behind firewall ACLs so only trusted administrative subnets can reach them, and for VIOS ensure the virtualization control plane is isolated from tenant/production traffic; the trade-off is that overly tight ACLs can disrupt legitimate I/O virtualization or management sessions, so validate which port/service is implicated via the advisory before blocking. Because the specific vulnerable component is not named in the public description, avoid disabling broad OS functionality blindly.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today