IBM AIX CVE-2026-17121

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special configuration prerequisites - remote unauthenticated exploitation is possible against any network-reachable IBM AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1 instance running the affected service. No non-default feature, specific protocol mode, or operator-supplied configuration is named in the available description as a necessary condition. Exploitation is inherently limited to systems running the affected IBM operating system versions on IBM Power Systems hardware; no cross-platform or cross-architecture risk applies. The specific network service or protocol that triggers the uncontrolled recursion is not identified in available data - this is inferred from the AV:N metric - meaning defenders cannot isolate a single port or protocol as a definitive blocking target without vendor guidance. Impact is bounded strictly to availability; privilege escalation or data exfiltration are not achievable through this flaw.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) presents a straightforward, unauthenticated, low-complexity denial-of-service profile. Impact is strictly bounded to availability - no confidentiality or integrity exposure exists per the vector. No EPSS score was included in the available intelligence, preventing probabilistic exploitation assessment. The vulnerability has not been listed in the CISA KEV catalog, and no confirmed public proof-of-concept exploit is known, lowering near-term risk relative to its raw CVSS score. However, the risk is contextually elevated for VIOS deployments: VIOS often functions as the sole I/O virtualization layer for multiple LPARs, meaning a crash can cascade into unavailability across all hosted workloads on a Power node - effectively a single point of failure. The complete absence of authentication and interaction requirements reduces the barrier for exploitation significantly. Aggregate population-level risk is moderated by the limited deployment footprint of IBM Power hardware relative to commodity x86 platforms.

A remote attacker with network access to an IBM AIX or PowerVM VIOS service crafts a request or input sequence designed to trigger a recursive processing path in a network-facing component, such as a protocol handler or parsing routine. The recursion executes without adequate depth or termination checks, rapidly exhausting available stack space or CPU cycles and causing the targeted service or system to crash. No public exploit code has been identified at time of analysis, but the low-complexity CVSS vector (AC:L, PR:N) indicates the attack requires no special expertise or tooling once the triggering input format is known.