IBM AIX EUVD-2026-63636

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required at the protocol level - remote unauthenticated exploitation is possible against affected IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems without user interaction. The practical limiting factors are: the target must be one of the specific affected versions (AIX 7.2, AIX 7.3, or VIOS 4.1), the vulnerable network service must be reachable and enabled (IBM has not publicly named the exact affected daemon/component, so which listening service triggers the overflow is unconfirmed from available data), and no public exploit exists yet, raising the practical skill barrier. Hosts whose management/service interfaces are isolated on restricted networks are substantially less exposed despite the network vector.

The signals here partially conflict and should be weighed rather than taken at face value. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a maximally severe, unauthenticated, low-complexity network RCE, which on its own demands emergency prioritization. However, the EPSS score is only 0.32% (25th percentile), the CVE is not on CISA KEV, and no public exploit or POC is identified - so real-world exploitation is currently unproven and likely not yet widespread. The most probable explanation is that this is a genuinely dangerous but freshly disclosed, vendor-reported flaw on a specialized enterprise platform, where exploit development lags disclosure and the small install base keeps EPSS low; it is not evidence the flaw is hard to exploit. Because the affected products underpin mission-critical Power Systems and VIOS infrastructure, organizations running AIX 7.2/7.3 or VIOS 4.1 should treat patching as high priority despite the low EPSS, while recognizing that the 9.8 is a theoretical worst case not yet corroborated by in-the-wild activity. Note the tension explicitly: high CVSS and confirmed vendor patch versus low EPSS and no observed exploitation - plan for urgency but without assuming active mass exploitation.

An attacker with network reachability to an exposed service on an AIX 7.2/7.3 or VIOS 4.1 host sends a crafted request whose oversized or malformed field overflows a heap buffer, corrupting heap memory to hijack execution and run arbitrary code in the context of the vulnerable process. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed, so the attack can be fully remote and automated once the vulnerable endpoint is located. No public POC or exploit is identified at time of analysis, so exploitation currently requires original vulnerability-research effort.