IBM AIX CVE-2026-17157

The attacker needs network reachability to the affected AIX 7.2/7.3 or VIOS 4.1 service that processes the malicious input; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required. The IBM description does not name the specific service, port, protocol, or configuration that exposes the overflow, so it cannot be confirmed whether a non-default feature must be enabled - this is a gap to resolve via the IBM advisory. Limiting factors: exploitation requires the vulnerable service to be network-exposed rather than firewalled off, and successful RCE via a stack overflow on modern AIX may need to defeat platform stack-protection mitigations, which can raise real complexity beyond the AC:L rating.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case profile: network-reachable, low complexity, no privileges, no user interaction, with full confidentiality, integrity, and availability impact. That maximal severity is tempered by real-world signals: the vulnerability is not in CISA KEV (no confirmed active exploitation), no public POC or exploit code has been identified, and no EPSS score was provided in the input, so exploitation probability cannot be quantified here. A meaningful caveat is that the description is extremely terse - it does not state which network service is affected or whether that service is exposed in default configurations, so the AC:L/PR:N assumptions should be verified against the IBM advisory; memory-corruption RCE on modern AIX may in practice require bypassing stack protections, which can raise real-world attack complexity above the CVSS AC:L rating. Overall this is a genuine high priority for AIX/VIOS operators due to the platform's role in critical enterprise workloads, but the absence of exploitation evidence suggests prompt patching rather than emergency response.

An attacker with network access to an exposed AIX or VIOS service sends a crafted request whose oversized payload overflows a fixed-size stack buffer, overwrites the saved return address, and redirects execution into attacker-controlled code, yielding arbitrary code execution on the host without any credentials or user interaction. Given AV:N/AC:L/PR:N, exploitation could be attempted directly against a reachable service, though no public exploit code has been identified at time of analysis.