IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 contain a buffer overflow that allows a local attacker to execute arbitrary code. The vulnerability can lead to local privilege escalation or full system compromise depending on the attacker’s existing access privileges. This is a high‑severity flaw classified as CWE‑787, reflecting an out‑of‑bounds write that can overwrite critical memory.

Affected systems include IBM AIX 7.2 and 7.3 across all standard levels, with cumulative service packs listed as SP13 for AIX 7.2 TL05, SP5 for AIX 7.3 TL02, SP3 for AIX 7.3 TL03, and SP2 for AIX 7.3 TL04. PowerVM VIOS 4.1 is impacted in all 4.1 release branches; the affected fix pack levels are VIOS 4.1.2 4.1.2.20, VIOS 4.1.1 4.1.1.30, and VIOS 4.1.0 4.1.0.50. All of these versions are cumulative, meaning the listed patches also contain fixes for preceding vulnerabilities.

The CVSS score of 9.3 indicates critical severity, while the EPSS score is not available, suggesting uncertain but potentially low public exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog, pointing to no known large‑scale exploitation. The attack vector is inferred to be local, requiring the attacker to have some level of physical or administrative access to the machine; remote exploitation is not documented. An attacker who successfully exploits the overflow can instigate arbitrary code execution, effectively taking full control of the affected environment.