AIX 7.2, 7.3 and PowerVM VIOS 4.1 are affected by an out‑of‑bounds write vulnerability that can be exploited by a remote attacker to cause a denial of service. The flaw stems from improper memory bounds checking, which, when triggered, can corrupt critical internal data structures and lead to system crashes or unresponsive services. This weakness is classified as CWE‑787.

Affected IBM products include AIX versions 7.2 and 7.3 across all supported release lines and PowerVM VIOS 4.1. For AIX, the remediation service packs are: SP13 for AIX 7.2 TL05, SP2 for AIX 7.3 TL04, SP3 for AIX 7.3 TL03, and SP5 for AIX 7.3 TL02. For VIOS, the relevant fix packs are 4.1.0.50 for VIOS 4.1.0, 4.1.1.30 for VIOS 4.1.1, and 4.1.2.20 for VIOS 4.1.2. These SP/FP levels are cumulative and can be applied on top of any earlier affected level within the same technology line. IBM provides the updates through Fix Central; installing the latest SP or FP mitigates the denial‑of‑service flaw.

The CVSS score is 4.3, indicating a medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the problem requires remote access to trigger the out‑of‑bounds write, the attack vector is likely remote. Exploitability depends on the ability to send crafted input to vulnerable services, but there are no public exploits known at this time. Nonetheless, applying the official patches mitigates the risk entirely.