IBM identifies a buffer‑overflow flaw in AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 that allows a remote attacker to execute arbitrary code. The vulnerability is a classic out‑of‑bounds write (CWE‑787) leading to remote code execution. Once exploited, the attacker can gain full system compromise, having the same privileges as the vulnerable process.

Affected are IBM AIX 7.2.0 through 7.3.x and IBM PowerVM VIOS 4.1.0 through 4.1.2. IBM recommends applying the cumulative Service Packs (AIX 7.3 TL04 SP2, AIX 7.3 TL03 SP3, AIX 7.3 TL02 SP5, and AIX 7.2 TL05 SP13) or the corresponding VIOS Fix Packs (VIOS 4.1.2.20, VIOS 4.1.1.30, VIOS 4.1.0.50). These packages consolidate all prior fixes and provide the necessary remediation.

The CVSS score of 9.8 classifies the vulnerability as Critical, and although an EPSS score is not available, the high severity indicates a high likelihood of exploitation if exploited by a determined attacker. The flaw is listed as not in the CISA KEV catalog, suggesting no known active exploits at the time of this analysis, but the lack of a KEV listing does not negate the potential for exploitation. The attack likely requires network access to the vulnerable system, and the vulnerability can be triggered remotely by sending specially crafted data that overflows a buffer.