A remote attacker can trigger a denial of service by sending a specially crafted request that fails to properly validate an array size field, causing the system to crash or become unresponsive. The flaw stems from an improper validation of user-supplied data, classified as an Out-of-Bounds Array Access (CWE-770). The impact is a loss of availability, preventing legitimate users from accessing the affected system until service is restored.

IBM AIX versions 7.2 and 7.3 and IBM PowerVM VIOS version 4.1 are affected. Specific remediation levels include AIX 7.3 TL04 SP2, AIX 7.3 TL03 SP3, AIX 7.3 TL02 SP5, AIX 7.2 TL05 SP13, VIOS 4.1.2 4.1.2.20, VIOS 4.1.1 4.1.1.30, and VIOS 4.1.0 4.1.0.50. Service Packs and Fix Packs are cumulative for all prior vulnerabilities and can be applied to any earlier level.

The CVSS base score of 7.5 indicates high severity. EPSS is not available, but the vulnerability is publicly known and documented by IBM, and the affected versions are widely deployed. As it can be triggered remotely, an attacker can easily target the system over the network, leading to immediate denial of service. The remediation requires applying the listed Service Packs or Fix Packs and rebooting the LPAR, though Live Update may avoid a reboot for AIX.