An out‑of‑bounds write in the kernel of IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 creates a local privilege escalation vulnerability. A malicious local user can trigger an overflow that overwrites control data in memory, allowing the attacker to execute code with elevated privileges or to bypass operating‑system safeguards. The flaw is classified as CWE‑787 and can compromise the confidentiality, integrity, or availability of the affected system if exploited.

Affected are IBM AIX operating systems 7.2 and 7.3 across all tenant levels up to TL04, as well as PowerVM VIOS 4.1.0, 4.1.1 and 4.1.2. Invoked Service Packs include AIX 7.3 TL04 SP2, TL03 SP3, TL02 SP5 and AIX 7.2 TL05 SP13; for VIOS, Fix Packs 4.1.2.20, 4.1.1.30 and 4.1.0.50 should be applied. These fixes are cumulative, covering all prior vulnerabilities, and can be installed through IBM Fix Central, with a system reboot required unless Live Update is used on AIX.

The CVSS base score of 7.8 indicates a medium‑to‑high severity local privilege escalation; however, the EPSS score is not reported, making exploitation frequency uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers must have local access, and the flaw exploits a kernel memory corruption, meaning that a successful exploit grants full system control. Immediate patching is recommended to reduce attack surface.