EUVD-2026-62524
GHSA-9fvh-889m-pf59
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent-network vector is consistent with a datacenter service not exposed to the internet; unauthenticated heap RCE yields full CIA impact on the vulnerable system with no scope change.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
AnalysisAI
Heap buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 enables unauthenticated remote code execution by attackers positioned on an adjacent network segment, with no user interaction required. The flaw (CWE-787, out-of-bounds write) results in full compromise of confidentiality, integrity, and availability of the affected system. A vendor patch has been released via IBM advisory; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
IBM AIX is a UNIX-based operating system running on IBM Power hardware, and IBM PowerVM VIOS (Virtual I/O Server) is the virtualization management layer that provides shared I/O resources to logical partitions running on the same physical Power server. The root cause is CWE-787 (Out-of-Bounds Write), a memory corruption class in which a process writes data beyond the boundary of a heap-allocated buffer, corrupting adjacent heap metadata or data pointers. In practice, this can allow an attacker to overwrite function pointers or return addresses, redirecting program execution to attacker-supplied shellcode or ROP gadgets. The CPE entries cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:* use wildcard sub-version fields, indicating that multiple minor releases within AIX 7.2/7.3 and VIOS 4.1 are potentially in scope; the IBM advisory at the referenced URL should be consulted for the exact affected build ranges.
RemediationAI
Patch available per vendor advisory: administrators should consult the IBM security bulletin at https://www.ibm.com/support/pages/node/7283858 for the specific APARs, interim fixes, or technology level updates applicable to IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1, and apply the appropriate fix as soon as operationally feasible. The exact patched version identifiers are not independently confirmed beyond the advisory reference, so verify the fix package against that bulletin before deployment. Where patching must be deferred, compensating controls should focus on network adjacency restriction: enforce VLAN segmentation to limit which hosts share a broadcast domain with IBM Power systems, apply ACLs at the switch or router level to block traffic from unauthorized sources to affected service ports, and audit firewall rules to ensure VIOS management interfaces are not reachable from general user segments. Note that VIOS manages I/O for all LPARs on the physical system, so patching should be coordinated with a maintenance window or LPAR live-migration to minimize service disruption.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today