Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.
Published: 2026-08-19
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An uninitialized stack pointer flaw in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a remote attacker, without authentication, to trigger a crash or halt of critical system components, resulting in a complete denial of service for the affected host or service. The weakness is classified as CWE‑908 and can be exercised by sending specially crafted traffic or otherwise exploiting the stack usage path.

Affected Systems

Affected products are IBM AIX 7.2 and 7.3 operating systems and IBM PowerVM VIOS 4.1 appliance software (4.1.0, 4.1.1, 4.1.2). Versions prior to the published Service Pack or Fix Pack levels are vulnerable: for AIX, Service Packs 7.3 TL04SP2, 7.3 TL03SP3, 7.3 TL02SP5 and 7.2 TL05 SP13; for VIOS, Fix Packs 4.1.2 4.1.2.20, 4.1.1 4.1.1.30 and 4.1.0 4.1.0.50.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity, and no EPSS score is reported. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote exploitation through network interfaces that process untrusted data, allowing an attacker to overflow or misdirect an uninitialized stack pointer and trigger a crash. The impact is loss of availability for the affected system components, potentially bringing down critical services or an entire logical partition.

Generated by OpenCVE AI on August 20, 2026 at 12:23 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Download and install the IBM AIX Service Pack that matches your version (e.g., 7.3 TL04SP2, 7.3 TL03SP3, 7.3 TL02SP5 or 7.2 TL05 SP13) from IBM Fix Central and apply it.
  • For PowerVM VIOS, apply the Fix Pack corresponding to your release (4.1.2 4.1.2.20, 4.1.1 4.1.1.30 or 4.1.0 4.1.0.50), reboot the logical partition to complete the update, or use Live Update for AIX to avoid a reboot.
  • If using nimsh secure, follow IBM’s updated protocol steps as documented in the advisory to safely apply the changes.
  • After upgrading VIOS 4.1.0 or 4.1.1, run the Postgres15 migration scripts from the IBM support pages linked in the advisory to ensure database compatibility.

Generated by OpenCVE AI on August 20, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Wed, 19 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-908
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-19T19:38:58.990Z

Reserved: 2026-07-24T02:23:15.607Z

Link: CVE-2026-16827

cve-icon Vulnrichment

Updated: 2026-08-19T19:38:45.481Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T20:17:03.353

Modified: 2026-08-24T15:54:47.410

Link: CVE-2026-16827

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T12:30:05Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource