EUVD-2026-63645
GHSA-wg3p-fqph-53qg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable AIX/VIOS host
-
DeliverySend crafted network payload
-
ExploitTrigger out-of-bounds write
-
ExecutionCorrupt process memory
-
ImpactCrash service or system
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration or feature flag is identified in available data as a prerequisite - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is a remotely triggerable, unauthenticated flaw requiring no special conditions beyond network reachability of the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system. Exploitation is limited by the requirement that the attacker have network access to the vulnerable host; systems behind strict ingress filtering or not network-exposed are meaningfully protected. Impact is limited to denial of service - no privilege escalation or data exfiltration is indicated. |
| Impact | CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) signals a straightforward, unauthenticated remote DoS with no complexity barriers - a serious operational concern for any organization running IBM Power infrastructure. However, EPSS at 0.49% (40th percentile) indicates low observed exploitation probability relative to the broader CVE population, and SSVC designates current exploitation status as 'none.' The SSVC 'Automatable: yes' flag is significant: the low attack complexity and absence of authentication requirements mean an attacker could scan and trigger crashes at scale with minimal effort, raising the practical risk above what the EPSS score alone suggests. There is no KEV listing and no public exploit code identified, meaning this is currently a patching priority rather than an emergency incident response scenario. The impact is limited to availability - no data disclosure or integrity compromise. Organizations running IBM AIX or PowerVM VIOS on internet-exposed or multi-tenant Power environments face the highest realistic exposure; air-gapped or heavily firewalled deployments have meaningful natural mitigation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a specially crafted network packet or series of packets to a vulnerable IBM AIX or PowerVM VIOS system, triggering an out-of-bounds write in the network-facing component. The resulting memory corruption causes the targeted service or system to crash, producing a denial-of-service condition. No public proof-of-concept code has been identified, but the low attack complexity makes independent rediscovery plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 25, 2026
Remote denial-of-service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows unauthenticated network attackers to crash affected systems via a buffer overflow. The flaw is classified as CWE-787 (out-of-bounds write), enabling complete availability impact with no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
Earlier versions of this analysis (1)
Network-reachable buffer overflow in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables unauthenticated remote attackers to crash affected systems via crafted network input, resulting in denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation with availability-only impact - no confidentiality or integrity consequences apply. No public exploit has been identified at time of analysis; a vendor patch is available via IBM's support portal (EUVD-2026-63645).
RemediationAI
Patch available per vendor advisory - apply the fix described at https://www.ibm.com/support/pages/node/7283858 as the primary remediation. An exact replacement version number is not independently confirmed from available data beyond the vendor's advisory. As compensating controls where immediate patching is not feasible: restrict inbound network access to the affected AIX and VIOS systems using host-based or perimeter firewalls to limit the attack surface, particularly blocking untrusted external hosts from reaching services that may process the triggering network input. Prioritize patching on VIOS hosts, as compromise of the I/O server layer can cascade to all hosted logical partitions on the same physical system.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM AIX is a proprietary Unix-based operating system running on IBM Power hardware; PowerVM VIOS (Virtual I/O Server) is the virtualization layer providing I/O services to logical partitions on IBM Power systems. Both are identified via CPE strings cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios. The root cause is CWE-787 (Out-of-bounds Write) - a buffer overflow where the affected component writes beyond its allocated memory region when processing remote network input, corrupting adjacent memory and causing a crash. The specific network-facing service or protocol triggering the overflow is not named in available data.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, no auth or user interaction required; impact is availability-only with no scope change per description.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a buffer overflow.
Executive ViewAI
IBM AIX and PowerVM systems in your environment are vulnerable to remote denial-of-service attacks that can crash production infrastructure, disrupting business operations. This affects AIX 7.2, 7.3, and PowerVM VIOS 4.1 deployments. Vendor patching is straightforward with low active exploitation risk (0.5% likelihood), making this a manageable priority for Q3 patching cycles.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB