EUVD-2026-62731
GHSA-xpp7-gg82-8wff
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-only access (AV:A), no credentials needed (PR:N), low complexity stack overflow yields full RCE with high CIA impact and no scope change.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
AnalysisAI
Stack buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables unauthenticated remote code execution by any attacker with adjacent network access. The flaw (CWE-787, Out-of-bounds Write) corrupts stack memory during processing of a crafted network payload, allowing an attacker to overwrite return addresses and redirect execution without requiring credentials or user interaction. No public exploit has been identified at time of analysis and IBM has released a patch, but the AV:A/PR:N/AC:L vector makes this a high-priority fix for any organization running IBM Power Systems infrastructure.
Technical ContextAI
IBM AIX is a UNIX-based operating system for IBM Power Systems hardware, and PowerVM VIOS (Virtual I/O Server) is the hypervisor-layer OS enabling virtualized I/O on IBM Power platforms - both share the vulnerable codebase, as reflected in CPE strings cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*. CWE-787 (Out-of-bounds Write) identifies the root cause as a stack buffer overflow: a network-reachable function writes beyond the bounds of a stack-allocated buffer, corrupting adjacent stack frames, potentially overwriting saved return pointers or function pointers to redirect program execution to attacker-supplied code. The CVSS AV:A vector indicates the vulnerability is triggered via a network service reachable from an adjacent Layer-2 segment (LAN, VLAN, or equivalent broadcast domain); the specific service or daemon is not identified in the available data.
RemediationAI
Patch available per vendor advisory - apply the IBM-supplied fix documented at https://www.ibm.com/support/pages/node/7283858 as the primary remediation. Exact patched APAR or PTF identifiers were not independently confirmed from the provided data; consult the advisory directly for the specific interim fix or technology level required for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1. As a compensating control while patching is scheduled, enforce network segmentation and firewall ACLs to restrict Layer-2 or adjacent-network access to AIX and VIOS management interfaces, limiting which hosts can reach the vulnerable service. This directly addresses the AV:A attack vector and reduces real-world exposure; trade-off is potential impact on legitimate network management traffic. Identify and restrict the specific network listener implicated in this overflow once IBM confirms service details in the advisory.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today