IBM AIX EUVD-2026-63726

No special conditions are required beyond network reachability to the affected IBM AIX or PowerVM VIOS system: the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of IBM AIX 7.2/7.3 and VIOS 4.1. Limiting factors are deployment-topology: AIX and VIOS management interfaces are commonly placed on dedicated management VLANs in well-hardened environments, which would restrict attacker reach. The specific network service or protocol handling the malformed allocation request has not been disclosed in the available data, which marginally complicates targeted exploitation but does not constitute a meaningful technical barrier once the vulnerable service is identified.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the worst-case accessibility profile: no authentication, no interaction, and reachable from the network with low complexity. Real-world priority is elevated because IBM AIX and PowerVM VIOS are typically found in high-value enterprise and government environments running mission-critical workloads; an availability disruption cascades to all logical partitions hosted on an affected VIOS system. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be numerically stated - this is a gap. No CISA KEV listing and no public exploit code have been identified, which moderates urgency relative to a CVSS 7.5 rating that might otherwise suggest immediate mass exploitation. The low attack complexity, however, means a working exploit would be trivial to automate once developed, and organizations should not conflate the current absence of public exploits with lasting safety.

An unauthenticated remote attacker sends a crafted network request containing an oversized allocation parameter to a network-facing service on an IBM AIX or VIOS system. The service attempts to allocate the requested resource without validating the size, exhausting kernel memory or equivalent resources, causing the service - or the entire system - to become unresponsive. In a PowerVM environment, a VIOS crash would deny I/O access to all logical partitions it serves, multiplying the operational impact.