A remote attacker can trigger an integer underflow in IBM AIX 7.2, AIX 7.3, and IBM PowerVM VIOS 4.1, causing the operating system or virtual infrastructure to crash. The flaw is an overflow/underflow vulnerability (CWE‑190) that culminates in a denial of service, disrupting availability for the affected system or virtual environment.

The vulnerability impacts IBM AIX 7.2 and 7.3, specifically service pack levels AIX 7.3 TL04SP2, TL03SP3, TL02SP5, and AIX 7.2 TL05 SP13, as well as IBM PowerVM VIOS 4.1.0, 4.1.1, and 4.1.2, which require the corresponding fix packs 4.1.0.50, 4.1.1.30, and 4.1.2.20. These patches are cumulative and supersede all prior security fixes for these platforms.

With a CVSS score of 9.8, this is a critical severity vulnerability. No EPSS score is available, so the probability of exploitation cannot be quantified precisely, and it is not currently listed in the CISA KEV catalog. The known attack vector is remote, and once the integer underflow is triggered the operating system or VIOS instance crashes, necessitating a logical partition reboot to recover. The simplicity of the exploit and the catastrophic impact on availability underscore the urgency of remediation.