The vulnerability is a heap-based buffer overflow that allows an attacker who can reach the affected system over the network to execute arbitrary code. This defect falls under CWE‑787 and is assigned a high CVSS score of 8.8, indicating significant potential damage to confidentiality, integrity, and availability of the affected platform.

IBM AIX versions 7.2 and 7.3, including all minor releases, and IBM PowerVM VIOS 4.1 are affected. The official resolution provides specific service pack and fix pack levels: for AIX 7.3 combinations such as TL04 SP2, TL03 SP3, TL02 SP5, and for AIX 7.2 TL05 SP13; for VIOS 4.1 channel the relevant fix packs are 4.1.0.50, 4.1.1.30, and 4.1.2.20. Any AIX or VIOS level below these should be elevated to the listed remedial level.

With a CVSS of 8.8, the flaw is considered high severity. No EPSS data is available, so the current probability of exploitation is uncertain, but the vulnerability is listed as not part of the CISA KEV catalog. The likely attack vector is remote, requiring a network connection to the affected system; an attacker would need to construct a payload that triggers the overflow in a vulnerable memory operation, thereby achieving full code execution.