Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
Published: 2026-08-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 contain a heap buffer overflow that allows a remote attacker to execute arbitrary code on the target system. The overflow can lead to full compromise of the affected platform, resulting in loss of confidentiality, integrity, and availability. The vulnerability is identified as CWE-787 and is rated high with a CVSS score of 8.8.

Affected Systems

The affected products are IBM AIX 7.2 and 7.3 release lines and IBM PowerVM VIOS 4.1. All sub‑versions in those lines are vulnerable, and IBM recommends updating to any of the following remediation levels: for AIX 7.3 TL04 Service Pack 2, AIX 7.3 TL03 Service Pack 3, AIX 7.3 TL02 Service Pack 5, AIX 7.2 TL05 Service Pack 13; for VIOS 4.1.0 Fix Pack 4.1.0.50, VIOS 4.1.1 Fix Pack 4.1.1.30, and VIOS 4.1.2 Fix Pack 4.1.2.20. These Service Packs and Fix Packs are cumulative and include all prior fixes.

Risk and Exploitability

The CVSS score of 8.8 indicates high potential impact. The EPSS score, listed as < 1%, shows a low probability of current exploitation in the wild. This vulnerability can be triggered by a remote network attacker with no special privileges, making remote exploitation plausible. It is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote, network‑based exploitation that triggers the heap overflow via externally supplied data, leading to arbitrary code execution.

Generated by OpenCVE AI on August 20, 2026 at 15:30 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Download and apply the latest AIX Service Pack or VIOS Fix Pack from IBM Fix Central for the affected platform.
  • After the update, perform an LPAR reboot; use Live Update on AIX if downtime must be avoided.
  • For VIOS 4.1.0 or 4.1.1, follow the post‑update migration instructions to upgrade to PostgreSQL 15 as documented in the provided IBM support links.
  • When using nimsh secure to apply the patches, follow the special procedure outlined in the IBM article linked in the advisory.

Generated by OpenCVE AI on August 20, 2026 at 15:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Wed, 19 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-787
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-20T18:28:21.017Z

Reserved: 2026-07-24T01:28:29.973Z

Link: CVE-2026-16814

cve-icon Vulnrichment

Updated: 2026-08-20T18:28:18.440Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T15:16:57.367

Modified: 2026-08-20T19:16:49.750

Link: CVE-2026-16814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T15:45:03Z

Weaknesses