The vulnerability is a stack buffer overflow in IBM AIX 7.2, AIX 7.3, and PowerVM VIOS 4.1 that allows a remote attacker to execute arbitrary code. This flaw can be triggered by external network traffic that reaches the vulnerable services, leading to full compromise of the affected host. The weakness is recorded as CWE-787 and carries the highest possible severity based on the CVSS score provided.

Affected vendors are IBM. The impacted products are IBM AIX versions 7.2 and 7.3 and IBM PowerVM VIOS 4.1. The mitigation guidance references AIX Service Pack 2 for AIX 7.3 TL04, Service Pack 3 for AIX 7.3 TL03, Service Pack 5 for AIX 7.3 TL02, and Service Pack 13 for AIX 7.2 TL05. For PowerVM VIOS the recommended levels are Fix Pack 4.1.2.20 for VIOS 4.1.2, Fix Pack 4.1.1.30 for VIOS 4.1.1, and Fix Pack 4.1.0.50 for VIOS 4.1.0. These updates are cumulative and contain fixes for all prior known vulnerabilities.

The CVSS score of 9.8 indicates a critical level of risk. EPSS is not available, so the likelihood of exploitation in the near term cannot be quantified, and the vulnerability is not listed in the CISA KEV database. The description indicates that a remote attacker can trigger the stack overflow from outside the host, so the attack vector is remote. Since the flaw permits arbitrary code execution, successful exploitation would give the attacker full control over the system.