IBM AIX EUVD-2026-63752

IPsec must be configured and active on the target host for the ESP decapsulation code path to be reachable - a host with IPsec disabled is not exposed. The attacker must be able to deliver IP protocol 50 (ESP) frames to the target host at the network layer, which may require L2 adjacency or a routable path to the IPsec endpoint. The SSVC 'Automatable: no' rating indicates that reliably triggering the corruption is not trivial, suggesting the crafted packet must satisfy enough ESP framing constraints to reach the vulnerable handler. No user interaction is needed. Authentication requirements per the vendor CVSS are PR:N (no privileges required), implying the handler may process packets before Security Association validation; however, this should be verified against the IBM advisory. Scope is limited to availability - no confidentiality or integrity impact applies.

The vendor-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) frames this as a trivially reachable remote DoS with no authentication or complexity barrier, but the SSVC signal 'Automatable: no' directly conflicts with AC:L - reliably triggering the ESP decapsulation code path to cause corruption likely requires crafting packets that satisfy enough of the IPsec framing to reach the vulnerable handler, which introduces practical attack complexity absent from the CVSS score. EPSS at 0.32% (25th percentile) confirms exploitation probability is low at this time, and CISA KEV absence corroborates no observed in-the-wild activity. SSVC rates technical impact as 'partial,' consistent with an availability-only impact (C:N/I:N). The key risk differentiator is deployment context: a crash on a standalone AIX server affects one host, while a crash on VIOS 4.1 can cascade to an entire logical partition cluster - organizations running PowerVM environments should assign higher operational priority accordingly. The discrepancy between AC:L (CVSS) and 'not automatable' (SSVC) should be resolved by reviewing the IBM advisory for precise exploitation conditions before making patch prioritization decisions.

A remote attacker sends a stream of specially crafted IPsec ESP packets (IP protocol 50) to an IBM AIX or VIOS host with IPsec configured. The malformed payload triggers the ESP decapsulation handler to consume uninitialized stack memory, corrupting kernel stack state and causing an immediate system panic. On a VIOS host, this results in complete loss of I/O services for all dependent LPARs until the hypervisor is manually restarted.