EUVD-2026-63739
GHSA-5w7c-9hff-vv9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AIX/VIOS network service
-
DeliveryAuthenticate (per vendor description)
-
ExploitSend crafted over-read request
-
ExecutionTrigger out-of-bounds read
-
ImpactLeak memory or crash service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the vulnerable AIX/VIOS network-facing service and the ability to send a crafted request that triggers the out-of-bounds read; the CVSS 3.1 vector (AV:N/AC:L/UI:N) indicates no user interaction and low complexity. There is an unresolved authentication condition: the CVE description states a 'remote authenticated attacker' (implying valid credentials/an established session are needed), while the CVSS vector encodes PR:N (no privileges) - treat authentication as likely required per the vendor description until IBM clarifies. Limiting factors that reduce real-world risk: the affected surface is IBM Power-specific enterprise Unix/VIOS not exposed on typical internet perimeters, EPSS/SSVC indicate no known automatable exploitation, and the probable authentication requirement further constrains who can reach the flaw. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) describes a network-reachable, low-complexity, no-interaction issue with high confidentiality and availability impact, which yields the 9.1 'Critical' score. However, there is a material conflict in the source data: the CVE description explicitly states a 'remote authenticated attacker,' which contradicts the vector's PR:N (no privileges required) - this should be verified with IBM, as it materially changes exposure (an authenticated-only bug on management-plane services like VIOS is meaningfully harder to reach than a truly unauthenticated one). Countervailing signals temper the raw score: EPSS is only 0.19% (10th percentile), CISA SSVC records Exploitation:none, Automatable:no, and Technical Impact:partial, and the issue is neither in CISA KEV nor backed by any public POC. Net assessment: this is a genuine, patch-worthy critical on paper but currently a low-likelihood, non-automatable threat - prioritize patching on internet- or management-network-exposed AIX/VIOS instances, but it does not carry the same urgency as an actively exploited KEV entry. Given AIX/VIOS run business-critical workloads, teams operating exposed VIOS management interfaces should schedule remediation promptly rather than defer. |
| Exploit ScenarioDerived | An attacker with network access to a vulnerable AIX or VIOS service sends a crafted request whose length or offset field drives the parser to read beyond an allocated buffer, returning adjacent memory contents that may contain sensitive data, or triggering an invalid access that aborts the service and denies I/O to dependent partitions. No public exploit code has been identified at time of analysis, and CVSS low attack complexity (AC:L) suggests a reliable trigger is feasible once the vulnerable request format is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 25, 2026
Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stem from an out-of-bounds read (CWE-125) reachable over the network, letting a remote attacker read sensitive memory contents or crash the affected service. The vulnerability carries a CVSS 9.1 rating driven by high confidentiality and availability impact, though EPSS places exploitation probability very low (0.19%, 10th percentile) and CISA's SSVC framework records no known exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Earlier versions of this analysis (1)
Out-of-bounds read in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 enables an authenticated attacker to disclose sensitive memory contents or trigger a denial of service on the affected system. The CWE-125 root cause - insufficient bounds validation during memory reads - is particularly consequential in the PowerVM virtualization stack, where a VIOS crash can cascade to all co-resident guest LPARs on the physical server. No public exploit code has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
RemediationAI
Patch available per vendor advisory: apply the fixes referenced in IBM support document https://www.ibm.com/support/pages/node/7283858 (no exact fixed version string is provided in the available data - obtain the correct APAR/ifix and TL/SP level for your AIX 7.2, 7.3, or VIOS 4.1 build directly from that advisory). Until the interim fix or service pack can be applied, reduce exposure by restricting network reachability of the affected service: place VIOS management and the vulnerable network interfaces behind firewall rules that permit only trusted administrative hosts, segment the VIOS/HMC management network away from general and internet-facing traffic, and enforce authentication controls on any remote access path - with the trade-off that tightening management-network ACLs may disrupt automation or monitoring tooling that currently reaches those interfaces and should be tested first. Because the impact includes DoS, ensure VIOS redundancy (dual-VIOS configurations) so that a crash of one server does not sever LPAR I/O.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds read (CWE-125), a memory-safety defect in which code reads past the bounds of an allocated buffer, typically because a length or index field derived from attacker-influenced input is not validated against the actual buffer size. The affected components are IBM's enterprise Unix operating system (cpe:2.3:o:ibm:aix for 7.2 and 7.3) and the PowerVM Virtual I/O Server (cpe:2.3:a:ibm:vios 4.1), which mediates virtualized storage and network I/O between the hypervisor and logical partitions (LPARs) on IBM Power hardware. Because VIOS underpins partition I/O, an OOB read there can leak adjacent process/kernel memory (potentially secrets or pointers) or dereference invalid memory and abort the handling process, causing service disruption. The tags (Information Disclosure, Buffer Overflow, Denial Of Service) are consistent with an over-read that both discloses memory and can crash the reader.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Description states an authenticated attacker so PR:L (not PR:N); network vector and low complexity retained, with high confidentiality and availability impact but no integrity impact.
Primary rating from Vendor (us).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.
Executive ViewAI
A critical vulnerability in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 could allow remote attackers to access sensitive data or disrupt operations, with potential business impact to organizations running these systems. While the vulnerability carries a CVSS rating of 9.1, current exploitation probability is extremely low (0.2% EPSS) with no public exploit identified at time of analysis, but absent vendor patches, immediate containment measures are necessary.
No vendor-released patch identified at time of analysis. Restrict network access to affected systems through firewall rules and network segmentation; disable non-essential network services on vulnerable platforms; implement enhanced monitoring, logging, and intrusion detection on IBM AIX and PowerVM systems; maintain incident response readiness for immediate patching upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB