EUVD-2026-63722
GHSA-wvpp-p4gf-mc93
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote attacker and RCE via integer overflow with no stated auth or interaction, so AV:N/AC:L/PR:N/UI:N; arbitrary code execution yields full C/I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.
AnalysisAI
Remote code execution in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, arises from an integer overflow (CWE-190) during a size computation that a remote attacker can trigger to run arbitrary code. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation with no user interaction, giving full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and low attack complexity are required, and the affected products are IBM AIX 7.2/7.3 and PowerVM VIOS 4.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are strong but partly incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the IBM-provided fix (iFix/APAR) as documented in IBM Security Bulletin https://www.ibm.com/support/pages/node/7283858 for each affected release - AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1; the specific patched technology level and interim-fix identifiers must be taken from that bulletin rather than assumed, so no exact fix version is stated here to avoid inventing one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 instances in your environment and restrict network access to administrative interfaces only; simultaneously, engage your IBM account team to obtain any interim guidance or undisclosed patches. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
Improper authentication in IBM AIX 7.2 and 7.3, and in IBM PowerVM VIOS 4.1, allows a remote attacker to execute arbitra
Remote code execution in IBM AIX 7.2 and 7.3 (and IBM PowerVM VIOS 4.1) stems from a stack-based buffer overflow that le
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a
Remote code execution in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, stems from a stack-based buffer overflow (CWE-78
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today