IBM AIX EUVD-2026-63736

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network reachability to the vulnerable service on IBM AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1 - no authentication and no user interaction are required against a default-accessible network service. The specific network service, protocol, and port containing the vulnerable parsing code are not named in available data, which limits precision in applying port-level compensating controls without the full IBM advisory. Exploitation is bounded by version: only AIX 7.2, 7.3, and VIOS 4.1 are confirmed affected - systems on other versions are not confirmed vulnerable. IBM Power and VIOS systems are typically deployed in enterprise data center networks behind perimeter controls rather than directly internet-exposed, which in many deployments limits realistic attackers to those with internal network access or access to management VLANs; however, this is a deployment assumption and must be verified per environment.

The CVSS 7.5 High score is driven by AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no authentication, no user interaction - representing a worst-case exploitability profile. Impact is constrained to availability (A:H) with no confidentiality or integrity consequence per vendor assessment, which partially offsets the exploitability concern. No EPSS score is available in the provided data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC code have been identified, reducing urgency relative to known-exploited flaws. However, IBM AIX and PowerVM VIOS underpin high-value enterprise infrastructure - ERP, databases, financial systems - where a denial-of-service condition carries significant operational and business continuity consequences disproportionate to a typical availability-only CVE. The low attack complexity means exploitation is not constrained to sophisticated actors. Priority should be elevated for organizations where AIX/VIOS availability is business-critical.

A remote unauthenticated attacker sends a specially crafted network request to an exposed IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system, supplying input that exceeds a stack buffer boundary in the affected network service. The overflow corrupts stack memory, causing the service or the host to crash and producing a denial-of-service condition. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates the overflow is reliably triggerable without specialized tooling.