EUVD-2026-62729
GHSA-w74v-4vvf-qm9c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes remote unauthenticated RCE via out-of-bounds write with no user interaction, so AV:N/AC:L/PR:N/UI:N and full C/I/A impact are consistent.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
AnalysisAI
Remote code execution in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows a remote attacker to run arbitrary code by triggering an out-of-bounds write (CWE-787) in an affected component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network by unauthenticated attackers with low complexity, yielding full compromise of confidentiality, integrity, and availability. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
AIX is IBM's proprietary UNIX operating system for POWER-architecture servers, and PowerVM VIOS (Virtual I/O Server) is the appliance-style AIX-based partition that virtualizes storage and network resources for LPARs on those systems - the shared VIOS lineage explains why both products are affected by the same defect. The root cause is CWE-787 (Out-of-bounds Write): a memory-corruption condition where the software writes past the bounds of an allocated buffer, typically due to missing or incorrect length/index validation on attacker-influenced input. On a network-facing service this class of bug can be leveraged to overwrite adjacent memory or control structures and redirect execution, which is consistent with the vendor's remote code execution characterization. The CPE strings (cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios) confirm the two distinct affected products but do not pinpoint the specific vulnerable service or daemon, which IBM's advisory has not disclosed in the provided data.
RemediationAI
Patch available per vendor advisory - apply the IBM-provided fix/interim fix (ifix) documented at https://www.ibm.com/support/pages/node/7283858 for AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1; the advisory lists the exact APAR and ifix packages per Technology Level, which should be applied since no specific patched version string was included in this intelligence. Because the affected network service is not identified in the available data, an effective interim compensating control until patching is to restrict network reachability of the affected hosts - place AIX/VIOS management and service interfaces behind firewall ACLs or a management VLAN so only trusted administrative subnets can reach them, accepting the trade-off that legitimate remote management paths must be explicitly allowlisted. For VIOS specifically, limit access to the padmin/management interfaces and virtual I/O service ports to the HMC and trusted admin hosts only, which reduces exposure without disrupting LPAR I/O virtualization. Verify fixes with IBM's advisory rather than assuming a full OS upgrade is required.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today