EUVD-2026-63719
GHSA-j437-fhrr-26hx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states remote arbitrary code execution via buffer overflow with no stated auth or interaction, supporting AV:N/AC:L/PR:N/UI:N and full C/I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
AnalysisAI
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from a buffer overflow (out-of-bounds write) that a remote attacker can trigger to run arbitrary code on affected IBM Power-based Unix systems. The flaw was reported by IBM's own PSIRT and carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs network reachability to the affected component on an IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 host and the ability to send crafted input that triggers the out-of-bounds write; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration is stated as required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point strongly toward high real-world risk rather than an inflated score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and the CIA impact is High/High/High, yielding 9.8. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply IBM's fix as the primary remediation: consult the IBM advisory at https://www.ibm.com/support/pages/node/7283858 and install the vendor-provided iFix or fix pack for your exact AIX 7.2/7.3 or VIOS 4.1 technology level - Patch available per vendor advisory, though an exact patched version string is not included in the provided data and must be taken from IBM's page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct complete inventory and discovery of all IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems across production and non-production environments to establish the scope of potentially affected infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today