EUVD-2026-62875
GHSA-396g-vpw6-q672
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only attack requiring a standard unprivileged account; full C/I/A:H reflects total system compromise via privilege escalation with no scope change.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve local privilege escalation due to an out-of-bounds write.
AnalysisAI
Local privilege escalation in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an out-of-bounds write (CWE-787) that allows a low-privileged local attacker to achieve complete system compromise across confidentiality, integrity, and availability. The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) reflects low-complexity exploitation requiring only a standard local account - a realistic threshold for insider threats or post-exploitation lateral movement within IBM Power environments. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; however, the total C/I/A:H impact on high-value enterprise Unix systems warrants prompt patching.
Technical ContextAI
CWE-787 (Out-of-Bounds Write) is a memory corruption class in which a program writes data beyond the allocated buffer boundary, enabling corruption of adjacent memory regions such as kernel data structures or function pointers. IBM AIX is a proprietary enterprise Unix operating system running exclusively on IBM Power hardware, widely deployed in banking, government, and critical infrastructure. IBM PowerVM VIOS (Virtual I/O Server) is the virtualization management layer on IBM Power systems that provides shared storage and network I/O to AIX and Linux logical partitions (LPARs). Both affected components are identified by CPE wildcard entries - cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:* - indicating the exact sub-version boundaries within AIX 7.2/7.3 and VIOS 4.1 are not narrowed in available NVD data and must be confirmed against the vendor advisory. An out-of-bounds write in a privileged OS component can corrupt kernel privilege control structures, enabling a user-mode process to escalate to root or supervisor level.
RemediationAI
The primary remediation is to apply the IBM-released patch referenced in the vendor advisory at https://www.ibm.com/support/pages/node/7283858. The exact fixed version number is not stated in available data and must be confirmed directly from the advisory - administrators should consult IBM Fix Central or the advisory page for the applicable Technology Level and Service Pack. As a compensating control while patching is scheduled, restrict local shell access on affected AIX and VIOS hosts to the minimum set of trusted accounts; review and tighten sudoers and setuid configurations to limit privilege escalation pathways, noting this does not eliminate the underlying vulnerability but narrows attacker opportunity. On VIOS hosts specifically, limit padmin and local OS-level account access to authorized virtualization administrators only. Applying network-level controls will not mitigate this local-only vulnerability.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today