EUVD-2026-62744
GHSA-r2pc-qxxr-v9g8
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AV:A confirmed by CVSS input; DoS-only impact with no confidentiality or integrity effect; no authentication or interaction required.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper check for an array index boundary.
AnalysisAI
Denial of service in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 is achievable by unauthenticated remote attackers positioned on an adjacent network segment, exploiting an improper array index boundary check (CWE-129). The flaw allows a crafted network request to trigger an out-of-bounds array access, crashing or degrading availability of the affected system. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis; a vendor patch is available via IBM Support.
Technical ContextAI
CWE-129 (Improper Validation of Array Index) describes a class of flaws where code fails to verify that a user- or network-supplied value falls within the valid bounds of an array before using it as an index. In IBM AIX and PowerVM VIOS, a component reachable from adjacent network segments accepts input that can supply an out-of-range index, causing the process to access memory outside the intended array boundaries. On IBM Power architecture systems, this can result in a kernel panic, service crash, or similar availability disruption. The CPE strings cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios confirm both the base operating system and the virtualization management layer are affected. PowerVM VIOS (Virtual I/O Server) is a specialized AIX partition providing virtualized I/O resources to client partitions, meaning an exploit could impact not only the VIOS partition itself but indirectly disrupt I/O service for hosted virtual machines.
RemediationAI
IBM has released a patch addressing this vulnerability, available through the IBM Fix Central portal. Organizations should apply the fix documented in IBM support page https://www.ibm.com/support/pages/node/7283858, which contains authoritative fix-level information for both AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1. Exact patched APARs or technology levels are specified in the advisory and should be verified before deployment. As a compensating control prior to patching, network segmentation should be enforced to ensure that IBM AIX and VIOS management interfaces are not accessible from untrusted adjacent network segments; this directly negates the AV:A attack vector and eliminates exploitability. Note that restricting adjacent network access to management planes is a trade-off involving reduced operational accessibility for administrators and monitoring tools. No workarounds beyond network isolation are documented in available references.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today