EUVD-2026-63722
GHSA-wvpp-p4gf-mc93
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AIX/VIOS service over network
-
DeliverySend crafted oversized input
-
ExploitTrigger integer overflow in size computation
-
ExecutionCorrupt memory via undersized allocation
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and low attack complexity are required, and the affected products are IBM AIX 7.2/7.3 and PowerVM VIOS 4.1. The description does not name the specific reachable service, port, or feature that performs the vulnerable size computation, so the concrete precondition is that the vulnerable network-facing component be exposed and reachable to the attacker - this should be confirmed against the IBM bulletin. Limiting factors: exploitation requires network reachability to the affected AIX/VIOS instance (organizations that isolate VIOS/AIX management and service interfaces on segmented networks materially reduce exposure), and only the listed versions are affected. Note the description hedges with 'could allow,' so reliable RCE may depend on specifics IBM has not published. |
| Impact | The signals here are strong but partly incomplete. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes remote, unauthenticated, low-complexity RCE with total system impact - the highest practical severity. However, EPSS is not provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC or exploit code has been identified, so exploitation status is currently 'no public exploit identified.' There is a tension worth flagging: the description says only 'could allow' RCE via an integer overflow during size computation without naming the reachable service or protocol, so while the vector asserts a pure network path, defenders should verify with IBM whether a specific listening service or configuration is required before treating AV:N as universally applicable. Given that AIX and VIOS underpin production Power workloads (databases, ERP, core banking), the combination of maximal CVSS and RCE means any operator - from a large enterprise to a mid-sized municipal IT team running a single Power frame - should treat this as urgent even absent public exploitation, since a single unauthenticated RCE against a hypervisor I/O server can cascade to every hosted LPAR. |
| Exploit ScenarioDerived | A remote attacker with network access to an affected AIX or VIOS host sends crafted input to a vulnerable service so that a size computation overflows an integer, causing memory corruption. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed, and the attacker leverages the corruption to execute arbitrary code with the privileges of the affected process. No public POC is currently identified, so an attacker would need to develop the exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Remote code execution in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, arises from an integer overflow (CWE-190) during a size computation that a remote attacker can trigger to run arbitrary code. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation with no user interaction, giving full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximal CVSS and RCE nature make this a top-priority patch for affected Power/AIX estates.
RemediationAI
Apply the IBM-provided fix (iFix/APAR) as documented in IBM Security Bulletin https://www.ibm.com/support/pages/node/7283858 for each affected release - AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1; the specific patched technology level and interim-fix identifiers must be taken from that bulletin rather than assumed, so no exact fix version is stated here to avoid inventing one. Until the iFix is deployed, reduce exposure by restricting network reachability to the affected AIX and VIOS management and service interfaces - place VIOS management, service, and I/O interfaces on isolated administrative VLANs and block untrusted access at the network layer (the trade-off is that overly aggressive filtering of VIOS I/O paths can disrupt LPAR storage/network virtualization, so scope firewall rules to management access rather than the virtualized data path). Prioritize VIOS hosts first, since compromise there can affect all client LPARs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic integer overflow (CWE-190) in a size-computation path within IBM's proprietary UNIX operating system (AIX) and the PowerVM Virtual I/O Server (VIOS), both of which run on IBM Power hardware. When a length or size value is calculated from attacker-influenced input, the arithmetic wraps around a fixed-width integer boundary, producing an undersized allocation or a bounds check that passes incorrectly; subsequent writes then corrupt memory, which is the mechanism leading to arbitrary code execution. VIOS is itself a specialized AIX-derived appliance that virtualizes storage and network I/O for LPARs, so the shared codebase explains why both AIX 7.2/7.3 and VIOS 4.1 are listed. No CPE strings were supplied in the input, so exact affected build/technology-level (TL/SP) granularity must be taken from IBM's advisory.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote attacker and RCE via integer overflow with no stated auth or interaction, so AV:N/AC:L/PR:N/UI:N; arbitrary code execution yields full C/I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.
Executive ViewAI
IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 systems face unauthenticated remote code execution risk due to an integer overflow vulnerability (CVE-2026-17160), enabling attackers to gain complete system control without authentication or user interaction. Organizations operating IBM Power architecture environments must immediately implement compensating controls and maintain contact with IBM, as no vendor-released patch identified at time of analysis. The critical CVSS rating (9.8) and breadth of affected enterprise infrastructure make this a top-priority security incident for Power-dependent operations.
Network segmentation and restrictive firewall rules limiting remote access to AIX and VIOS systems; disable or strictly rate-limit SSH and other remote administrative protocols on affected systems; deploy continuous network monitoring for exploitation indicators including unusual outbound connections and large data exfiltration; enable enhanced logging and audit trails on affected systems to detect unauthorized access; consider temporary air-gapping mission-critical Power Systems until vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB