EUVD-2026-63635
GHSA-gggw-wvph-xf37
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach affected AIX/VIOS network service
-
DeliverySend crafted malicious input
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt memory structures
-
ImpactRead and tamper with system data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are indicated - network-reachable, low-complexity, unauthenticated exploitation with no user interaction against affected IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems. However, the description does not name the specific vulnerable service, protocol, or listening port, so the concrete precondition (which network service must be exposed and enabled) cannot be extracted from the available data and should be confirmed via the IBM advisory. Limiting factors: only the enumerated versions (AIX 7.2, AIX 7.3, PowerVM VIOS 4.1) are in scope, exploitation is confined to hosts whose vulnerable service is actually network-exposed, and SSVC rates the flaw as not automatable, implying it is not trivially wormable. |
| Impact | The signals are mixed and skew toward moderate-to-high-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, network-reachable attack with high confidentiality and integrity impact, which drives the 9.1 base score; notably A:N means no availability/denial-of-service impact, which is unusual for a memory-corruption bug and worth verifying against the vendor advisory. Countering the high CVSS, EPSS is only 0.43% (36th percentile), CISA SSVC records Exploitation: none and Automatable: no, and there is no KEV listing and no public exploit identified - so real-world exploitation pressure is currently low despite the severe theoretical impact. SSVC Technical Impact is rated 'total', consistent with an OOB write that can subvert a privileged OS component. The description is sparse (no named service, protocol, or precondition), so the true attack surface and whether it is genuinely pre-authentication cannot be independently confirmed from the data provided. |
| Exploit ScenarioDerived | An attacker with network reachability to an affected AIX or VIOS host sends crafted input to the vulnerable network-facing service, triggering the out-of-bounds write to overwrite memory it should not, corrupting data structures to read protected information and tamper with system state (C:H/I:H). No user interaction or authentication is required per the CVSS vector, but no public exploit is identified at time of analysis, so exploitation would require original vulnerability research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 25, 2026
Out-of-bounds memory write in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a remote attacker corrupt process memory to compromise system confidentiality and integrity, but not availability, per the CVSS 9.1 vector. IBM has published a fix (support advisory node/7283858), and there is no public exploit identified at time of analysis. EPSS is low at 0.43% (36th percentile) and CISA SSVC records no observed exploitation, so this is a vendor-disclosed memory-corruption issue rather than a mass-exploited one.
Earlier versions of this analysis (1)
Out-of-bounds write in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables remote unauthenticated attackers to compromise system confidentiality and integrity. The CWE-787 memory corruption flaw is reachable over the network but requires high attack complexity (AC:H), indicating a non-trivial precondition such as a specific protocol state, timing condition, or service configuration. IBM has confirmed the vulnerability and released a patch; no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Patch available per vendor advisory: apply the fixes IBM provides at https://www.ibm.com/support/pages/node/7283858 for the affected AIX 7.2/7.3 and PowerVM VIOS 4.1 levels; the input does not include a specific fixed version string, so retrieve the exact interim fix or service pack level from that advisory and match it to your installed technology level. Because the vulnerable component is network-reachable, interim compensating controls until patching completes should restrict network exposure of the affected hosts: place AIX and VIOS management/service interfaces behind firewall rules or a management VLAN so only trusted administrative hosts can reach them, which reduces the remote attack surface at the cost of tighter operational access. For VIOS specifically, limit access to the partition to the HMC and authorized admin networks; note that over-restricting VIOS network paths can disrupt virtual I/O serving to client LPARs, so validate changes in a maintenance window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM AIX is IBM's proprietary Unix operating system for Power Systems hardware, and PowerVM VIOS (Virtual I/O Server) is the AIX-based partition that virtualizes storage and network resources for LPARs on the same platform - the two share substantial code lineage, which explains why both are affected. The root cause is CWE-787 (Out-of-bounds Write): code writes past the bounds of an allocated buffer, allowing an attacker to overwrite adjacent memory or control structures. CPE data confirms the affected components are the operating-system-level packages cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios, indicating a flaw in a network-reachable OS service rather than a third-party application.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description states remote confidentiality and integrity compromise with no stated availability impact; sparse detail supports vendor's unauthenticated network vector, so AV:N/PR:N/UI:N and C:H/I:H/A:N retained.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and integrity of the system due to an out-of-bounds write.
Executive ViewAI
A critical memory vulnerability in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 (CVE-2026-17003) could allow attackers to gain unauthorized access to system data and bypass security controls. Organizations using these IBM systems for business-critical applications or data processing are at risk of data breach and system compromise. IBM has published a patch; prompt assessment and remediation of vulnerable systems is essential.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB