The vulnerability is a NULL pointer dereference that an attacker can trigger remotely to cause a denial of service. This flaw does not expose data, but it can disrupt the availability of the operating system or virtualization host, potentially taking the entire platform offline without user interaction.

Affected systems are IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1. For AIX the vulnerable Service Packs are SP2, SP3, SP5, and SP13, including the 7.3 TL04 SP2, 7.3 TL03 SP3, and 7.3 TL02 SP5 levels, and the 7.2 TL05 SP13 level. For VIOS the pending Fix Packs are 4.1.0.50, 4.1.1.30, and 4.1.2.20 – any versions below those FP levels are affected.

The CVSS score is 7.5, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, a remote attacker can exploit the vulnerability over the network without local privileges, potentially causing a service outage. Because the flaw is a null pointer dereference, it likely occurs when the system processes malformed or unexpected input from a network component. The impact is strictly on availability, with no confirmed paths to compromise confidentiality or integrity.