EUVD-2026-63723
GHSA-8wv8-p4rq-h2hm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-reachable IBM AIX or VIOS service
-
DeliveryCraft packet with malformed array size field
-
ExploitTransmit to vulnerable parsing routine
-
ExecutionTrigger unvalidated resource allocation
-
PersistKernel fault or memory exhaustion
-
ImpactSystem crash and denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability to the affected service - remote unauthenticated exploitation against default-configured IBM AIX 7.2, 7.3, or PowerVM VIOS 4.1 systems. The specific network service, protocol, or port containing the vulnerable array size validation is not identified in the available data and must be confirmed from the IBM advisory. Exploitation is strictly limited to denial of service: no confidentiality or integrity compromise is possible via this vulnerability. Environments that restrict inbound network access to IBM Power management interfaces using strict firewall policies or private management VLANs substantially reduce practical exposure, as the attack requires direct network connectivity to the vulnerable service. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a worst-case availability scenario: network-reachable, trivially exploitable, requiring no credentials or user interaction. In isolation that signals high urgency. However, IBM AIX and PowerVM VIOS are deployed almost exclusively in enterprise data centers on IBM Power hardware - the attack surface is narrow by architecture, not by configuration. No EPSS data was provided, limiting probabilistic exploitation forecasting. KEV status is negative and no POC is known, which together suggest opportunistic mass exploitation is not currently occurring. The real priority concern is targeted attacks against financial institutions, government agencies, and critical infrastructure operators that commonly run IBM Power environments: a VIOS crash can simultaneously deny service to all hosted LPARs, making this a high-impact vector in those specific contexts. The missing data points - specific vulnerable service, port, and exact fix version - prevent a complete risk picture; defenders should consult the IBM advisory directly. |
| Exploit ScenarioDerived | An attacker with network access to an IBM AIX or PowerVM VIOS system sends a specially crafted packet containing an attacker-controlled array size value to the vulnerable service. The system processes the malformed size without validation, triggering uncontrolled resource allocation or an invalid memory operation that causes a kernel panic or system hang. In the PowerVM VIOS context, this brings down shared I/O for all dependent guest LPARs simultaneously, causing cascading outages across virtualized workloads. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Denial of service in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker to crash affected systems by supplying a crafted request that exploits improper validation of an array size field. The CVSS 7.5 (High) score reflects a fully network-exploitable, zero-complexity, no-privilege-required attack path targeting availability exclusively. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting this has not yet been weaponized at scale.
RemediationAI
Consult the IBM support advisory at https://www.ibm.com/support/pages/node/7283858 for available patches, interim fixes (IFixes), or Technology Levels for IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 - a specific fix version is not independently determinable from the available data. As compensating controls pending patch application: restrict network access to IBM AIX and VIOS management interfaces using firewall ACLs, allowing connectivity only from trusted administrative hosts and known client LPARs; this reduces the attack surface without affecting internal virtualization functions. If the vulnerable component can be identified from the advisory (e.g., a specific daemon or network service), consider disabling it if not operationally required, noting that disabling VIOS-facing services may impact guest LPAR I/O availability. Prioritize VIOS patching over standalone AIX instances given the multiplied blast radius of a VIOS crash.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-770 (Allocation of Resources Without Limits or Throttling) describes a failure to bound resource consumption before acting on attacker-controlled size values. Here, an array size field - likely in a network-facing parsing routine - is accepted and used without range validation, enabling an attacker to trigger excessive memory allocation, out-of-bounds processing, or kernel-level fault conditions. IBM AIX is IBM's proprietary Unix operating system exclusively for POWER-architecture servers. IBM PowerVM VIOS (Virtual I/O Server) is a dedicated logical partition on IBM Power Systems hardware providing shared storage and network virtualization to guest LPARs; a crash of VIOS disrupts I/O for all dependent guest partitions simultaneously, amplifying the DoS impact beyond a single OS instance.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-facing service accepts unauthenticated input with no interaction; impact is purely availability with no confidentiality or integrity loss and no scope change.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an array size field.
Executive ViewAI
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 systems face a remote denial-of-service vulnerability requiring no authentication that can crash affected infrastructure. Organizations dependent on these platforms risk unplanned service outages and operational disruption until patch availability is confirmed. This threatens business continuity for any workloads running on affected IBM enterprise systems.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to affected systems through firewall rules and network segmentation; implement connection rate limiting and throttling on system interfaces; establish real-time monitoring for abnormal traffic patterns and potential exploitation attempts; escalate requests to IBM support for environment-specific hardening measures and timeline for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB