IBM AIX CVE-2026-17124

Exploitation requires an existing local account on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system with at minimum low-level (non-root) privileges, as confirmed by PR:L in the CVSS vector. No user interaction is required (UI:N) and attack complexity is rated Low (AC:L), meaning no specific non-default configuration, race condition, or environmental prerequisite must be satisfied beyond local authenticated access. The unchanged scope (S:U) indicates the exploit does not inherently traverse VM or partition isolation boundaries from within a VIOS context. Exploitation is fundamentally bounded by the local access requirement: remote unauthenticated attackers cannot directly trigger this vulnerability without first obtaining a local foothold via another vector. The CVE description does not identify a specific feature flag, configuration setting, or non-default deployment mode as a prerequisite - the vulnerability appears to be present in default installations of the affected versions.

The CVSS 3.1 score of 7.8 (High) accurately captures the severity of the impact - full C/I/A compromise - while the local attack vector (AV:L) and low privilege requirement (PR:L) constrain the realistic attacker population to those who already hold a local foothold. Attack complexity is rated Low (AC:L), meaning no race conditions or environmental dependencies must be met beyond local access, which is a meaningful risk amplifier in multi-tenant AIX or shared VIOS environments. No EPSS score was included in the provided intelligence, limiting probabilistic forecasting; this gap should be addressed before making patch-prioritization decisions. The CVE is not listed in the CISA KEV catalog, and no public proof-of-concept exploit was identified, indicating no confirmed widespread exploitation as of the analysis date. Despite the absence of KEV status, the combination of low complexity, no user interaction, and critical impact on VIOS infrastructure - which underpins multiple virtualized workloads on a single physical host - means a successful exploit could cascade across co-hosted partitions; organizations running shared POWER infrastructure should treat this as urgent regardless of KEV listing. SSVC analysis suggests an 'Attend' posture: exploitation is not yet confirmed, but technical impact is total and the attack path is not complex.

A local user with a standard low-privilege account on an IBM AIX or PowerVM VIOS 4.1 system invokes a vulnerable binary or system interface, triggering an out-of-bounds read that corrupts adjacent memory in a controlled manner. By crafting inputs to manipulate memory layout, the attacker redirects execution flow and achieves arbitrary code execution, potentially escalating to root or gaining control of the VIOS partition managing co-hosted virtual machines. No public exploit code has been identified, but the low attack complexity in the CVSS vector indicates exploitation does not require sophisticated heap shaping or race condition timing.