A stack buffer overflow in IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 allows a remote attacker to execute arbitrary code. An attacker exploiting the flaw can gain local or elevated privileges on the target system, potentially compromising confidentiality, integrity, or availability of the affected platform. The vulnerability is inherent to the affected software and does not require any configuration changes to be exploitable.

IBM AIX 7.2 and 7.3 as well as IBM PowerVM VIOS 4.1 are impacted. The following remediation levels are recommended: for AIX, Service Pack 7.3 TL04 SP2, 7.3 TL03 SP3, 7.3 TL02 SP5, and 7.2 TL05 SP13. For VIOS, Fix Pack 4.1.2 4.1.2.20, 4.1.1 4.1.1.30, and 4.1.0 4.1.0.50. These Service Packs and Fix Packs include cumulative fixes for all previously published vulnerabilities and can be applied to any earlier affected level of the technical level.

The CVSS score of 9.8 indicates a critically high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog at this time. Inference based on the description suggests the attack vector is remote, likely over a network interface, because the flaw results from an external, unchecked input leading to a stack buffer overflow. An attacker with network access to the affected system can trigger the overflow and execute arbitrary code without needing local access.