EUVD-2026-62829
GHSA-c6cw-cvvr-xq54
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain foothold on adjacent network segment
-
DeliverySend crafted request to AIX/VIOS service
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt adjacent memory
-
PersistExecute arbitrary code or crash service
-
ImpactRCE or denial of service on Power host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network adjacency to the target (CVSS AV:A) - the attacker must be on the same local/adjacent network segment (e.g., the same VLAN, L2 broadcast domain, or management network as the AIX host or VIOS partition), not the open internet. No authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), so any adjacent host can attempt it against default-reachable instances of AIX 7.2/7.3 or PowerVM VIOS 4.1. The primary limiting factor is this adjacency requirement, which confines the attack surface to systems where an attacker already has local network access; note the description's 'remote attacker' wording conflicts with AV:A and should be verified with IBM, as internet-facing exposure would remove this limit. |
| Impact | The signals are strong but incomplete. CVSS 3.1 is 9.6 Critical with AV:A (adjacent network, not full internet-wide reachability), AC:L (low complexity), PR:N (no authentication), UI:N (no user interaction), and full C/H/I/H/A/H impact under a changed scope - indicating easy, unauthenticated exploitation for anyone on the same L2/adjacent network segment. However, the description says 'remote attacker' while the CVSS vector specifies AV:A (adjacent); this is a meaningful discrepancy - verify with IBM whether the affected service is exposed on general networks or only adjacent/management segments, as it materially changes exposure. EPSS exploitation probability was not provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation yet. Net assessment: a genuine high-priority patching target for AIX/PowerVM operators because of the unauthenticated code-execution potential, but the adjacent-only vector and absence of any exploit evidence suggest real-world risk is currently latent rather than actively weaponized. |
| Exploit ScenarioDerived | An attacker with a foothold on the same adjacent network segment as a Power server (for example a compromised host in the same data-center VLAN or management network) sends crafted traffic to the vulnerable AIX/VIOS service, triggering the out-of-bounds write. With no authentication or user interaction required, the corruption is used either to execute arbitrary code in the affected component's context or to crash it for denial of service. No public POC is referenced, so an attacker would need to develop the memory-corruption exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
RemediationAI
Consult the IBM PSIRT advisory at https://www.ibm.com/support/pages/node/7283858 and apply the fixes/ifixes (interim fixes) IBM provides for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 as your primary remediation; patch available per vendor advisory, but no exact fixed build level was provided in the input, so obtain the precise APAR/ifix from IBM before deployment. Because the CVSS vector is AV:A (adjacent), the most effective compensating control until patching is network segmentation: restrict access to the affected AIX/VIOS management and I/O network segments so only trusted hosts share the adjacent broadcast/L2 domain, and place VIOS management interfaces on an isolated administrative VLAN - the trade-off is added routing/firewall complexity and possible disruption to legitimate management tooling. Where feasible, disable or firewall the specific network-facing service once IBM identifies it, accepting reduced functionality of that service as the side effect. Do not rely on authentication as a control, since exploitation requires no privileges (PR:N).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (Out-of-bounds Write): a service or kernel/hypervisor component in AIX and the VIOS (Virtual I/O Server) partition of PowerVM writes attacker-influenced data past the bounds of an allocated buffer, corrupting adjacent memory. AIX is IBM's proprietary Unix operating system for POWER-architecture servers, and VIOS is the specialized appliance partition that virtualizes storage and network I/O for logical partitions (LPARs) on a PowerVM system. Because IBM assigned a changed scope (S:C), the memory corruption is expected to affect resources beyond the immediately vulnerable component - consistent with a privileged I/O virtualization or system service context. IBM's advisory does not disclose the exact vulnerable component or protocol, so the precise parser/service that performs the out-of-bounds write is not confirmed from available data.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent unauthenticated low-complexity out-of-bounds write yielding RCE/DoS on a privileged virtualization/system component justifies AV:A, PR:N, changed scope, and full C/I/A high impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code or cause a denial of service due to an out-of-bounds write.
Executive ViewAI
Critical vulnerability in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows unauthenticated adjacent-network attackers to achieve arbitrary code execution or service denial through out-of-bounds memory writes. Organizations operating IBM Power infrastructure face immediate risk of unauthorized system compromise and business disruption in the absence of available patches.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict adjacent-network access to affected IBM AIX and PowerVM VIOS systems; enforce strict firewall policies permitting only required administrative and application traffic from trusted sources. Deploy network-based intrusion detection monitoring traffic patterns to affected systems. Maintain offline backups and tested recovery procedures. Monitor IBM security advisories for patch releases; prioritize systems for patching immediately upon vendor availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB