IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 contain a stack buffer overflow that can be triggered by a remote attacker to execute arbitrary code. The flaw allows the attacker to write beyond the bounds of a buffer, corrupting the stack and potentially gaining full control of the vulnerable process. The impact of exploitation is the ability to run arbitrary code with the privileges of the vulnerable service, which can lead to a full system compromise. This vulnerability is catalogued as CWE‑787, a classic buffer overflow weakness.

The affected products are IBM AIX 7.2 (all releases prior to SP13) and AIX 7.3 (all releases prior to SP5, SP3, or SP2 depending on the target TL04, TL03, TL02, or TL05). For PowerVM VIOS, versions 4.1.0, 4.1.1, and 4.1.2 that lack the corresponding Fix Packs 4.1.0.50, 4.1.1.30, or 4.1.2.20 are vulnerable. IBM has released APARs and cumulative Service Packs or Fix Packs that address the vulnerability across these versions.

The CVSS score of 9.8 marks this flaw as Critical, and although the EPSS score is not available, the lack of a KEV listing does not diminish its potential impact. The vulnerability is exploitable over the network, and a successful attack would require creating a specially crafted request that triggers the overflow. IBM recommends applying the latest SP/FP immediately, followed by a reboot (or using Live Update on AIX) and additional migration to Postgres15 for VIOS 4.1.x as described in the release notes. Failure to patch exposes the system to remote code execution that could be leveraged by unauthenticated attackers.