IBM AIX EUVD-2026-63675

Exploitation requires an existing local shell session on the target IBM AIX (7.2 or 7.3) or PowerVM VIOS (4.1) system with at least low-level OS privileges (PR:L per CVSS). The vulnerability is not remotely exploitable over a network; AV:L confirms the attacker must be operating locally on the system. No user interaction is required once local access is established (UI:N). The specific subsystem or trigger condition within AIX/VIOS is not disclosed in available data, so it is unknown whether a non-default configuration or specific feature must be active. Exploitation is not considered automatable per SSVC, limiting the threat to targeted post-compromise scenarios rather than mass scanning. The primary limiting factor for defenders is controlling and auditing local account access on IBM Power infrastructure.

The CVSS 7.8 score reflects a serious but local vulnerability: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the attacker must already have a low-privileged local shell, but once present, exploitation is low-complexity and requires no user interaction - yielding full system impact. The EPSS score of 0.17% (7th percentile) is very low, suggesting the broader threat intelligence community does not currently expect widespread automated exploitation, which is consistent with the SSVC determination of exploitation: none and automatable: no. However, SSVC also rates technical impact as total, confirming that successful exploitation yields full system compromise. There is no CISA KEV listing and no known public POC. The combination of a local attack vector, absence of automation, and low EPSS materially reduces operational urgency compared to the raw CVSS score alone - this is a high-severity but targeted, post-initial-access risk rather than a mass-exploitation concern.

An attacker who has obtained a low-privileged local account on an IBM AIX or PowerVM VIOS system - for example, through credential theft, reuse, or a separate initial-access vulnerability - crafts input designed to overflow a heap buffer in a vulnerable AIX or VIOS component. The overflow corrupts adjacent heap metadata or a function pointer, redirecting execution to attacker-controlled code and achieving arbitrary code execution, likely at an elevated privilege level. No public exploit code has been identified at time of analysis.