IBM AIX EUVD-2026-63734

The vendor description states exploitation is possible by a remote attacker, but the supplied CVSS vector specifies AV:L (local access), creating an unresolved conflict that must be clarified with IBM before defenders can accurately scope exposure. Under the AV:L interpretation, an attacker with local system access (but no credentials per PR:N) must trigger the out-of-bounds read, possibly through a locally accessible socket, device node, or IPC mechanism. Under the description's remote-attacker framing, no local presence is required. No specific configuration flag or non-default feature is identified as a prerequisite; however, IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 must be the exact running versions. Exploitation is limited by: the niche deployment environment (IBM Power hardware), the AV:L vector if accurate, and the absence of known public exploit tooling.

The vendor CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, score 7.7) presents a notable internal conflict: AV:L denotes local access, yet the IBM description explicitly states 'remote attacker' as the threat actor. This discrepancy must be verified with IBM - either the vector understates network reachability (AV:L should be AV:N) or the description overstates the attack surface. If AV:N is correct, the real-world score would be substantially higher (~9.1). EPSS data is absent from provided intelligence, limiting probability-of-exploitation quantification. KEV status is negative and no public POC is identified, indicating no confirmed active exploitation. Despite the dual high-impact profile (C:H, A:H), the niche enterprise footprint of AIX and PowerVM constrains broad blast radius. However, IBM Power environments often host critical financial and enterprise workloads, making targeted exploitation of high-value targets plausible. The AV:L/PR:N combination in the vendor vector is atypical and warrants clarification - PR:N with local access may indicate a scenario exploitable by any unprivileged local entity without credentials, or it may be a vector assignment error.

A remote attacker sends a specially crafted network request targeting a vulnerable parsing or protocol-handling path in IBM AIX or PowerVM VIOS. The malformed input triggers an out-of-bounds read, either causing the targeted service or process to crash (denial of service against VIOS-hosted LPARs) or returning memory contents from outside the intended buffer (potentially leaking kernel memory, partition data, or credentials). No public proof-of-concept code is known to exist at time of analysis.