IBM AIX and PowerVM VIOS versions 7.2, 7.3 and 4.1 contain a stack‑based buffer overflow that can be triggered by a remote authenticated user. The flaw allows the attacker to execute arbitrary code on the affected system, compromising confidentiality, integrity and availability of the host and potentially any services running on it. The vulnerability is characterized as CWE‑121 and carries a CVSS score of 8.8, indicating high severity.

Affected products include IBM AIX 7.3 TL04, 7.3 TL03, 7.3 TL02, 7.2 TL05 and IBM PowerVM VIOS 4.1.2, 4.1.1, 4.1.0. The vendor recommends applying the cumulative Service Pack 2 for AIX 7.3 TL04, Service Pack 3 for 7.3 TL03, Service Pack 5 for 7.3 TL02 and Service Pack 13 for 7.2 TL05. For PowerVM VIOS, the applicable fixes are Fix Pack 4.1.2.20 for 4.1.2, 4.1.1.30 for 4.1.1 and 4.1.0.50 for 4.1.0.

With a CVSS score of 8.8 the risk is considered high. Although a current EPSS score is not available, the vulnerability is known to be exploitable and is not yet listed in the CISA KEV catalog. An attacker must first authenticate to the system; from there, the buffer overflow can be triggered by sending specially crafted input to affected services. Rebooting the LPAR completes the update, and on AIX Live Update can avoid the reboot. Because the flaw requires authentication, internal attackers or compromised credentials pose the greatest threat.