EUVD-2026-62728
GHSA-v3g4-vgfp-mmr7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Remote unauthenticated packet parsing (AV:N/AC:L/PR:N/UI:N); out-of-bounds read leaks sensitive memory (C:H) and can crash the parser (A:H), but a read does not alter data (I:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser.
AnalysisAI
Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The flaw lives in the network stack's handling of IPv4 IP options - the optional variable-length fields (e.g., record-route, timestamp, source-routing) appended to an IPv4 header. Parsing these requires arithmetic on option lengths against remaining header space; an integer underflow (a subtraction wrapping below zero into a large unsigned value) causes the parser to read past the intended buffer boundary, the classic CWE-125 out-of-bounds read. Because IP-options parsing happens in kernel/low-level networking code on the affected IBM operating systems (AIX per cpe:2.3:a:ibm:aix and PowerVM VIOS per cpe:2.3:a:ibm:powervm_vios), the leaked data can be adjacent kernel or network-buffer memory. PowerVM VIOS is the Virtual I/O Server appliance that brokers storage and network I/O for LPARs on IBM Power hardware, so the same networking code is exposed there.
RemediationAI
Patch available per vendor advisory: apply the IBM-provided fix documented at https://www.ibm.com/support/pages/node/7283858 for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 (consult that page for the exact APAR/iFix or ioslevel to install, as no specific fix version was included in the source data). Until patching, reduce exposure by restricting IPv4 reachability of AIX and VIOS management/service interfaces to trusted segments, and where operationally acceptable drop inbound IPv4 packets carrying IP options at perimeter firewalls or routers (most modern traffic does not require IP options, so this typically has low functional impact but should be validated against any tools relying on record-route/timestamp options). Keep VIOS management networks isolated from general user traffic to shrink the remote attack surface.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today