EUVD-2026-62834
GHSA-5239-8prx-9h9f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AIX/VIOS network service
-
DeliverySend crafted request with oversized length value
-
ExploitTrigger integer overflow (CWE-190)
-
ExecutionCorrupt memory / out-of-bounds write
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are indicated - remote unauthenticated exploitation without user interaction against IBM AIX 7.2/7.3 and PowerVM VIOS 4.1. The concrete prerequisite is network reachability to the specific (undisclosed in the available data) AIX/VIOS network service whose parser mishandles the integer overflow; the IBM advisory does not name that service or state whether it is enabled by default, which is the key unknown limiting a precise reachability judgment. Practical limiting factors: exploitation is constrained to the listed versions (AIX 7.2, 7.3; VIOS 4.1) on IBM Power hardware, and if the vulnerable service is not network-exposed or is firewalled off, the attack surface is removed despite the network vector. |
| Impact | The signals are mostly aligned toward high priority but incomplete. The CVSS 3.1 vector is unambiguous about severity: network attack vector, low complexity, no privileges, and no user interaction, with high impact across C/I/A, which is the classic 9.8 unauthenticated-RCE profile. However, corroborating exploitation signals are absent or missing: there is no KEV listing, no POC referenced, and no EPSS probability supplied in the input, so real-world exploitation likelihood cannot be quantified from the data provided. The single reference is a generic IBM support node URL with no descriptive title, and no SSVC decision data (exploitation status, automatable, technical impact) was provided. Net assessment: treat as a high-priority patch candidate for any Power/AIX/VIOS estate because the theoretical impact and reachability are severe, but note that active exploitation is unconfirmed and the technical specifics (affected service, whether the vulnerable code path is exposed by default) are not disclosed in the available data and should be verified against the IBM advisory. |
| Exploit ScenarioDerived | An attacker with network access to an exposed AIX 7.2/7.3 or VIOS 4.1 service sends a crafted request containing a length or count value engineered to trigger the integer overflow, causing memory corruption in the parsing code. Given AV:N/AC:L/PR:N/UI:N, this requires no credentials and no user interaction, and successful exploitation yields arbitrary code execution on the host. No public exploit code has been identified at time of analysis, so weaponization effort is presently unknown. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Remote code execution in IBM AIX 7.2 and 7.3, and in the IBM PowerVM VIOS 4.1 virtualization stack, stems from an integer overflow (CWE-190) that a network-based attacker can trigger without authentication or user interaction. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated remote exploitation with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was supplied in the input.
RemediationAI
Apply the IBM-provided fix per the vendor advisory at https://www.ibm.com/support/pages/node/7283858; IBM typically ships AIX and VIOS security fixes as interim fixes (ifixes) and APAR-referenced fileset updates rather than a single version string, and no exact fixed fileset version was included in the supplied data, so treat this as patch available per vendor advisory and pull the exact ifix/APAR from that page. Because the affected service is not disclosed in the input, a precise network-level workaround cannot be named with confidence; as compensating controls pending patching, restrict network reachability to AIX and VIOS management and service interfaces using host and network firewalls so only trusted management subnets can reach them, and place VIOS management interfaces on an isolated administrative VLAN - the trade-off is that overly broad filtering can disrupt LPAR I/O virtualization or legitimate remote administration, so scope rules to the specific hosts and ports IBM identifies in the advisory. Do not rely on these controls as a substitute for the ifix once released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AIX is IBM's proprietary UNIX operating system for Power Systems hardware, and VIOS (Virtual I/O Server) is the PowerVM appliance that virtualizes storage and network I/O for LPARs on the same platform, so both share substantial low-level system code. The root cause is classified as CWE-190 (Integer Overflow or Wraparound), where an arithmetic operation produces a value that exceeds the storage width of its type; this typically leads to an undersized buffer allocation or a bypassed bounds check, enabling a subsequent out-of-bounds write and memory corruption that is leveraged for code execution. The IBM advisory reference does not disclose the exact affected component or protocol, so the specific service parsing the attacker-controlled length or count value is not identified in the supplied data. No CPE strings were provided in the input to further narrow the exact affected builds.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote code execution via integer overflow with no stated auth or interaction, matching AV:N/AC:L/PR:N/UI:N and full C/I/A impact from arbitrary code execution.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow.
Executive ViewAI
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain a critical remote code execution vulnerability allowing unauthenticated network-based exploitation with full system compromise potential, directly impacting enterprise infrastructure. No vendor patch is currently available; while no public exploit is identified at time of analysis, the vulnerability's CVSS 9.8 score and ease of exploitation demand immediate compensating controls. Rapid network segmentation and monitoring implementation are essential to reduce risk pending patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: Implement network segmentation and strict firewall policies restricting inbound and outbound communication with affected systems; disable or restrict remote access protocols (SSH, Telnet, RSH) where operationally feasible; deploy IDS/IPS with signatures for this vulnerability class; implement enhanced logging and real-time alerting for any remote connection attempts and process execution on affected systems; enforce strict access controls limiting administrative and service access; conduct regular security assessment of network access to these systems; and maintain rapid patching procedures for immediate deployment upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB