IBM AIX and PowerVM VIOS contain a flaw that permits a remote attacker to exhaust system resources, leading to a denial of service. The vulnerability is identified as CWE‑400, indicating uncontrolled resource consumption. Once triggered, the affected system can become unresponsive, halting legitimate processes without compromising data integrity or confidentiality.

The flaw affects IBM AIX releases 7.2 and 7.3 and IBM PowerVM VIOS 4.1. Specific vulnerable versions include AIX 7.2 and 7.3 with various minor releases and VIOS 4.1.0 and 4.1.1. The remediation levels are defined by the listed Service Packs (AIX 7.3 TL04 SP2, 7.3 TL03 SP3, 7.3 TL02 SP5, 7.2 TL05 SP13) and VIOS Fix Packs (4.1.2.20, 4.1.1.30, 4.1.0.50).

The CVSS score of 7.5 reflects a high severity, and while the EPSS score is unavailable it indicates that exploit prevalence data is not yet quantified. The vulnerability is not recorded in CISA’s KEV catalog, suggesting no confirmed widespread exploitation at the time. Exploitation requires remote access to the affected AIX or VIOS instance; the attacker can trigger the resource exhaustion by sending crafted input or otherwise provoking the system to allocate excessive resources. Successful exploitation results in service disruption, and the attack can be conducted without requiring privileged credentials if the affected system is exposed to untrusted traffic.