EUVD-2026-62834
GHSA-5239-8prx-9h9f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote code execution via integer overflow with no stated auth or interaction, matching AV:N/AC:L/PR:N/UI:N and full C/I/A impact from arbitrary code execution.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow.
AnalysisAI
Remote code execution in IBM AIX 7.2 and 7.3, and in the IBM PowerVM VIOS 4.1 virtualization stack, stems from an integer overflow (CWE-190) that a network-based attacker can trigger without authentication or user interaction. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated remote exploitation with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are indicated - remote unauthenticated exploitation without user interaction against IBM AIX 7.2/7.3 and PowerVM VIOS 4.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mostly aligned toward high priority but incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the IBM-provided fix per the vendor advisory at https://www.ibm.com/support/pages/node/7283858; IBM typically ships AIX and VIOS security fixes as interim fixes (ifixes) and APAR-referenced fileset updates rather than a single version string, and no exact fixed fileset version was included in the supplied data, so treat this as patch available per vendor advisory and pull the exact ifix/APAR from that page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 systems across your infrastructure using asset management and network scanning tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
Improper authentication in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, allows a remote attacker to execute arbitra
Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that le
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a
Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-78
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today