IBM AIX EUVD-2026-63637

Exploitation requires an active local user account on the affected system with at minimum standard (low-privilege) access - confirmed by the CVSS PR:L metric. No user interaction from another party is required. No special non-default configuration is indicated by the description or CVSS vector; the vulnerability appears present in default AIX and VIOS deployments running the affected versions. Exploitation is limited by the local attack vector (AV:L): the attacker must have interactive or programmatic local access to the target system, eliminating remote unauthenticated exploitation. SSVC confirms the attack is not automatable, meaning mass exploitation across many systems simultaneously is not feasible. The flaw is version-specific, limited to AIX 7.2, 7.3, and PowerVM VIOS 4.1 - systems running AIX 7.1 or earlier, or future patched levels, are outside the confirmed scope.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H scores 7.1 (High), driven by the dual high-impact outcomes (memory disclosure and DoS) achievable by any local standard user without additional complexity or interaction. However, the local attack vector materially limits exposure: an attacker must already have a local account on the affected system, ruling out unauthenticated remote exploitation. EPSS at 0.15% (5th percentile) reflects extremely low exploitation probability in the current threat landscape, consistent with SSVC confirming exploitation status as 'none' and the attack as non-automatable. No CISA KEV listing and no public POC further support this as a low-urgency finding despite the High CVSS score. The primary risk scenario is insider threat or post-compromise lateral movement on shared AIX/VIOS systems. No CVSS/description conflict detected: the local vector is consistent with the description of a local attacker. The missing data point is the exact patched version number - IBM's advisory should be consulted to confirm which specific fix level addresses the flaw.

An attacker with a standard local user account on an IBM AIX 7.3 LPAR or PowerVM VIOS 4.1 system crafts or invokes a system call or library function that triggers the out-of-bounds read, reading memory beyond an allocated buffer. Depending on what memory region is accessed, the attacker extracts sensitive data such as kernel structures, credentials, or other process memory, or provokes a kernel fault that crashes the affected component and denies service to all users of that LPAR or shared VIOS instance. No public proof-of-concept code has been identified at time of analysis.