IBM AIX 7.2 and 7.3, together with IBM PowerVM VIOS 4.1, contain an out-of-bounds write that can be triggered by a local attacker. The flaw does not provide any privilege escalation or remote code execution capability; it merely allows the attacker to crash or otherwise destabilize the system, which can lead services or the operating system itself to fail. The impact is strictly on availability, causing denial of service to processes and possibly broader application stacks running on the affected LPAR.

The affected systems are IBM AIX releases 7.2 and 7.3 and IBM PowerVM VIOS release 4.1. For AIX, the cumulative Service Packs that fix this vulnerability are Service Pack 2 for TL 04, Service Pack 3 for TL 03, Service Pack 5 for TL 02, and Service Pack 13 for the 7.2 lineage. For PowerVM VIOS, the corresponding Fix Packs are 4.1.2.20 for VIOS 4.1.2, 4.1.1.30 for VIOS 4.1.1, and 4.1.0.50 for VIOS 4.1.0. These levels include all prior security fixes and are cumulative.

The CVSS score is 4.4, indicating moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector is local, an attacker must have privileged or console access to the target LPAR to exploit the out-of-bounds write. There is no remote exploitation path, no privilege escalation, and no compromise of confidentiality. The availability impact is the primary concern, warranting prompt patching and, for AIX, a possible LPAR reboot unless Live Update is employed to apply the Service Pack without downtime.