The vulnerability permits a remote attacker to trigger a heap-based buffer overflow that can crash the AIX or PowerVM VIOS service, resulting in a denial of service. The flaw is a classic memory corruption flaw (CWE‑122) that can be exploited without authentication, effectively disrupting the availability of the affected operating system or hypervisor.

The issue affects IBM AIX 7.2 and 7.3 as well as IBM PowerVM VIOS 4.1. The recommended remediation levels are the AIX Service Packs SP2 for 7.3 TL04, SP3 for 7.3 TL03, SP5 for 7.3 TL02, and SP13 for 7.2 TL05, and the VIOS Fix Packs 4.1.2.20, 4.1.1.30, and 4.1.0.50. These updates are cumulative and apply to all earlier affected versions, with IBM providing the necessary APARs for each level.

The CVSS score of 7.5 indicates high severity, while the EPSS score is not available, leaving the likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the AIX or VIOS host and could exploit the flaw remotely; no special privileges are required beyond that. Because the flaw can crash the entire OS or hypervisor, it presents a system‑wide availability risk that could cripple critical workloads.