The vulnerability affects IBM AIX 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1, by causing an improper calculation of a memory offset when IPsec packets are decapsulated. An attacker who can send crafted IPsec traffic to the target can trigger a signed integer overflow leading to a buffer overrun, which will crash critical processes and result in a denial of service. The weakness, identified as CWE-191, has a CVSS score of 7.5, meaning it is a high‑severity flaw that can be exploited remotely without local privileges.

IBM AIX versions 7.2 and 7.3 on all supported service packs are affected, as are all releases of IBM PowerVM VIOS 4.1.0, 4.1.1, and 4.1.2. The specific fix levels are listed in the vendor advisory, with AIX Service Pack 2 for AIX 7.3 TL04, Service Pack 3 for AIX 7.3 TL03, Service Pack 5 for AIX 7.3 TL02, and Service Pack 13 for AIX 7.2 TL05. For the VIOS platform, Fix Pack 4.1.2.20 for VIOS 4.1.2, 4.1.1.30 for VIOS 4.1.1, and 4.1.0.50 for VIOS 4.1.0 are required.

The CVSS score of 7.5 indicates that the flaw is high risk, yet the EPSS score is not available, so the exact likelihood of exploitation is uncertain. The vulnerability is not listed in any KEV catalog. Attackers would most likely exploit it remotely through IPsec traffic, taking advantage of the improper offset calculation during decapsulation. Because the flaw is in kernel code handling network packets, it does not require prior authentication, making the attack vector straightforward for an adversary with network access to the machine.