Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T20:17:04.553Z",
  "pubdate": "2026-08-19T20:17:04.553Z",
  "executiveSummary": "This vulnerability involves an uncontrolled resource consumption flaw affecting IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1. The weakness manifests as a denial of service vulnerability, allowing an unauthenticated remote attacker to exhaust critical system resources.\nThe primary impact of successful exploitation is the degradation or complete disruption of system availability, rendering affected operating system instances and virtualization environments unresponsive. This poses severe risk implications for enterprise environments relying on continuous availability of Power architecture workloads.\nThe attacker capabilities required to trigger the condition include network accessibility to the vulnerable service and the ability to send maliciously crafted requests designed to induce excessive resource allocation. No specific privileges or prior authentication are explicitly mandated based on the remote exploitation vector.\nExploitation requirements center on the target system exposing network services susceptible to resource amplification or unbounded allocation patterns without proper rate limiting or threshold enforcement. Organizations utilizing the specified IBM AIX and PowerVM VIOS versions face potential service outages if remediation actions are not applied.",
  "technicalDetails": "The root cause of the vulnerability stems from improper resource management and a lack of adequate bounds checking or rate limiting within vulnerable components of IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1. When processing specific network inputs, the affected subsystem fails to properly release or restrict the allocation of memory, CPU cycles, or internal descriptors.\nThe vulnerable component handles incoming remote requests by allocating persistent system structures or spawning execution threads proportional to the input parameters. Because input validation and resource throttling are insufficient, an attacker can supply carefully constructed payloads that maximize resource consumption per transaction.\nThe attack flow proceeds as follows: First, the remote attacker establishes a network connection to the targeted service running on the IBM AIX or PowerVM VIOS host. Second, the attacker transmits a series of malformed or high-frequency requests designed to trigger the uncontrolled resource allocation path within the target function. Third, the operating system kernel or system daemon continuously dedicates memory and processing power to handle or queue the incoming requests without enforcing an upper threshold.\nAs resource pools deplete, the underlying operating system encounters memory exhaustion or thread starvation. This leads to system-wide instability, kernel panics, or the unresponsiveness of critical management daemons, culminating in a complete denial of service condition.\nAffected versions explicitly include IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1. The exploitation vector is network-exposed, requiring no authentication or prior system privileges, thereby increasing the potential attack surface for external or internal threat actors positioned within network reach of the vulnerable endpoints."
}