EUVD-2026-62727
GHSA-4cv2-jwvj-h9m8
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector and low privilege confirmed by description; AC:H reflects inherent difficulty of winning TOCTOU timing race; full C/I/A at High justified by critical file overwrite and sensitive data access potential.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use (TOCTOU) race condition.
AnalysisAI
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. No public exploit or CISA KEV listing exists at time of analysis; IBM has released a vendor patch.
Technical ContextAI
CWE-367 (Time-of-Check Time-of-Use Race Condition) describes a class of flaw where a program checks a resource's state and then acts on it, but an attacker can modify the resource in the intervening window before use. IBM AIX is an enterprise-grade UNIX operating system based on AT&T System V, commonly deployed on IBM Power Systems hardware. IBM PowerVM VIOS (Virtual I/O Server) is the AIX-based virtualization management layer enabling I/O resource sharing across logical partitions on IBM Power Systems. TOCTOU vulnerabilities in these environments typically manifest in setuid binaries, privileged daemons, or system utilities that perform file existence or permission checks before operating on those files, creating a symlink-swap or file-substitution window. The CPE strings cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:* confirm the vulnerability spans both product lines across the affected version ranges.
RemediationAI
IBM has confirmed a vendor-released patch is available for this vulnerability; administrators should consult the IBM support advisory at https://www.ibm.com/support/pages/node/7283858 for the specific fix pack or maintenance level applicable to their AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1 deployment, as the exact patched version number was not independently confirmable from the available data. As a compensating control prior to patching, restricting local interactive login to the minimum required set of trusted users reduces the attacker pool, since PR:L is a prerequisite - however, this does not eliminate risk in multi-user environments where shared access is operationally required. Enabling file integrity monitoring on critical system files (for example, via IBM AIX's built-in Trusted Execution mechanism or a third-party FIM tool) can help detect post-exploitation overwrite activity, though detection after a successfully won race condition may be retrospective rather than preventive.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today