EUVD-2026-62736
GHSA-373j-r8x5-fj8c
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Adjacent network vector aligns with IBM's own assessment; unauthenticated null pointer dereference produces only a crash with no confidentiality or integrity impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
AnalysisAI
Denial of service in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker exploiting a null pointer dereference, capable of crashing the targeted system without requiring authentication or user interaction. The vulnerability affects IBM's enterprise UNIX operating system and its PowerVM Virtual I/O Server layer, where availability is operationally critical for hosted workloads. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires adjacent network access (AV:A) - the attacker must be on the same network segment, subnet, or VLAN as the targeted IBM AIX or PowerVM VIOS host; exploitation from the open internet is not possible with this attack vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (Medium) reflects the availability-only impact combined with the adjacent network constraint, which meaningfully limits the exploitable population compared to fully network-reachable vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to the same network segment as an IBM AIX or PowerVM VIOS host sends a specially crafted network packet that reaches the vulnerable code path and triggers the null pointer dereference, causing the system to crash and denying service to all workloads running on that host or virtual I/O server. No authentication or user interaction is required, lowering the attacker's operational burden once adjacent network positioning is achieved. … |
| Remediation | The primary remediation is to apply the vendor-released patch referenced in the IBM support advisory at https://www.ibm.com/support/pages/node/7283858; exact fix version numbers should be obtained directly from that advisory, as they are not independently confirmed in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improp
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run a
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today