EUVD-2026-63738
GHSA-cjp4-x5rh-9pqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AIX/VIOS network service
-
DeliverySend crafted request with malformed size field
-
ExploitTrigger integer underflow in size calculation
-
ExecutionForce out-of-bounds read or bad allocation
-
ImpactCrash service and leak adjacent memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required and exploitation is remote against the affected service - the limiting factor is network reachability of the vulnerable AIX 7.2/7.3 or VIOS 4.1 service, which in well-segmented Power environments is typically confined to a management network. The provided data does not name the exact vulnerable daemon, protocol, or whether a non-default configuration is required, so the precise triggering endpoint should be confirmed from the IBM advisory; realistic risk is highest where AIX/VIOS management or network services are exposed beyond a trusted segment. |
| Impact | The signals are mixed. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H) frames this as critical: network-reachable, low complexity, no privileges or user interaction, with high confidentiality and availability impact. However, corroborating exploitation signals are weak - EPSS is only 0.51% (41st percentile), SSVC records Exploitation as 'none', and the vulnerability is not in CISA KEV, so this is a serious-but-not-yet-exploited issue rather than an active emergency. Counterbalancing that, SSVC marks the flaw Automatable=yes with partial technical impact, meaning that if a reliable trigger emerges it could be scripted at scale, so exposed AIX/VIOS management interfaces should be prioritized for patching. Note a plausible tension worth verifying with IBM: the description says only that the flaw 'could... potentially disclose sensitive information,' which reads as uncertain/limited, yet the vector encodes C:H - the true confidentiality impact may be lower than the headline score implies. |
| Exploit ScenarioDerived | An attacker with network access to an exposed AIX or VIOS service sends a crafted request whose length or size field triggers the integer underflow, wrapping a size calculation to a huge value. The resulting out-of-bounds access crashes the targeted service (denying I/O virtualization on VIOS or a network service on AIX) and may return fragments of adjacent process memory to the attacker. No public exploit code has been identified, so this remains a plausible but not yet demonstrated attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 25, 2026
Remote denial-of-service and potential information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 arises from an integer underflow (CWE-190 class) reachable over the network without authentication. An unauthenticated remote attacker can send crafted input that triggers the arithmetic wraparound, crashing an affected service and possibly reading sensitive memory contents. There is no public exploit identified at time of analysis, EPSS is low (0.51%, 41st percentile), and it is not on CISA KEV.
Earlier versions of this analysis (1)
Remote unauthenticated denial of service and limited information disclosure affect IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, via an integer underflow in a network-accessible component. The CVSS 8.2 High rating reflects zero authentication barriers (PR:N/UI:N) over a network vector, with high availability impact and incidental confidentiality leakage. No public exploit code and no CISA KEV listing have been identified at time of analysis.
RemediationAI
Apply the fixes described in IBM's advisory at https://www.ibm.com/support/pages/node/7283858; the provided data confirms a patch is available per vendor advisory but does not include an exact fixed version/technology level, so obtain the specific APAR/ifix or TL/SP levels for AIX 7.2, AIX 7.3, and VIOS 4.1 directly from that IBM support page (do not rely on an assumed version number). Until patched, reduce exposure by restricting network reachability of the affected AIX/VIOS services to trusted management networks only - place VIOS and AIX management interfaces behind firewall ACLs or a dedicated management VLAN, and block untrusted access to the affected service port. These access restrictions trade off remote manageability and may disrupt legitimate remote administration or virtualization workflows, so scope them to management subnets rather than blanket blocks, and monitor the affected services for crashes as an interim detection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AIX is IBM's proprietary Unix operating system for POWER architecture servers, and PowerVM VIOS (Virtual I/O Server) is the AIX-based appliance that virtualizes storage and network I/O for LPARs on Power systems. The root cause is an integer underflow - classified under CWE-190 (Integer Overflow or Wraparound) - in which a subtraction or size calculation drops below zero and wraps to a very large unsigned value. Such a miscalculated length/index can then drive an out-of-bounds read or an undersized allocation, producing both the availability loss (crash) and the confidentiality exposure (reading adjacent memory) noted in the description. The CPE data confirms the affected components as the AIX operating system (cpe:2.3:o:ibm:aix) and the VIOS application (cpe:2.3:a:ibm:vios); the specific vulnerable network-facing service or daemon is not identified in the provided data.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote unauthenticated low-complexity trigger justifies AV:N/AC:L/PR:N; DoS gives A:H, but the description's tentative 'potentially disclose' supports C:L rather than C:H, with no integrity impact.
Primary rating from Vendor (us).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and potentially disclose sensitive information due to an integer underflow.
Executive ViewAI
Critical remote denial-of-service vulnerability in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows unauthenticated attackers to crash affected services and potentially read sensitive memory without authentication. Organizations running these core virtualization and server systems face immediate risks to infrastructure availability and data confidentiality with no vendor patch currently available.
Network segmentation to restrict remote access to affected AIX and VIOS systems; disable non-essential network services where operationally feasible; deploy IDS/IPS detection for exploitation attempts; implement enhanced monitoring and alerting for unexpected service crashes or memory anomalies; maintain current backups and DR procedures; consider air-gapping or restricting these systems to isolated management networks until patches or upgrades are deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB