EUVD-2026-62727
GHSA-4cv2-jwvj-h9m8
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector and low privilege confirmed by description; AC:H reflects inherent difficulty of winning TOCTOU timing race; full C/I/A at High justified by critical file overwrite and sensitive data access potential.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use (TOCTOU) race condition.
AnalysisAI
TOCTOU race condition in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 permits a local, low-privileged user to overwrite critical system files or extract sensitive information by exploiting the timing gap between a file-check and file-use operation. The attack is constrained to local access with high exploitation complexity, yet the potential impact spans full confidentiality, integrity, and availability compromise of the affected system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A local user account with at least low-level system access is required, as confirmed by PR:L in the CVSS vector; unauthenticated or purely remote exploitation is not possible given AV:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H correctly reflects a local attack requiring low-privilege user access and high exploitation complexity - AC:H captures the inherent difficulty of reliably winning a timing race, which typically demands repeated attempts and often benefits from specific system load or scheduling conditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with a standard account on an IBM AIX or PowerVM VIOS system identifies a setuid binary or privileged system utility that performs a file permission or existence check prior to writing to or reading from a target path. The attacker repeatedly triggers the operation while simultaneously swapping the target path with a symbolic link pointing to a critical system file, eventually winning the race window between the check and use phases to redirect the privileged write or read to an unintended target. … |
| Remediation | IBM has confirmed a vendor-released patch is available for this vulnerability; administrators should consult the IBM support advisory at https://www.ibm.com/support/pages/node/7283858 for the specific fix pack or maintenance level applicable to their AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1 deployment, as the exact patched version number was not independently confirmable from the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM AIX 7.2, 7.3, or PowerVM VIOS 4.1 and map which systems have multiple local user accounts or shared access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improp
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an unauthenticated remote attacker to run a
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today