Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write.
Published: 2026-08-19
Score: 6.7 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an out‑of‑bounds write that allows a local attacker to execute arbitrary code on affected IBM systems. An attacker with local access could trigger the flaw to gain code execution privileges, potentially leading to full system compromise.

Affected Systems

IBM AIX 7.2 and AIX 7.3 platforms, as well as IBM PowerVM VIOS 4.1. The issue is present across all sub‑versions of these families that have not been updated to the latest Service Packs or Fix Packs.

Risk and Exploitability

The CVSS score of 6.7 marks the flaw as medium severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV. Because the flaw requires local access and an out‑of‑bounds write, exploitation would be feasible only for users with sufficient local privileges. Nevertheless, the potential for arbitrary code execution means that unpatched systems remain at risk until the official Service Pack or Fix Pack updates are applied and the system is rebooted or updated via Live Update.

Generated by OpenCVE AI on August 19, 2026 at 23:09 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Apply the IBM AIX Service Packs or PowerVM VIOS Fix Packs that contain the APARs: SP2 or later for AIX 7.3 TL04, SP3 for TL03, SP5 for TL02, SP13 for 7.2, or the corresponding VIOS Fix Packs 4.1.2.20, 4.1.1.30, or 4.1.0.50.
  • If running VIOS 4.1.0 or 4.1.1, follow the post‑update instructions to migrate to Postgres15 using the links provided by IBM.
  • Restart the LPAR or use Live Update to apply the Service Pack or Fix Pack changes and complete the update, noting that special Nimsh secure steps may be required for communication with the master.

Generated by OpenCVE AI on August 19, 2026 at 23:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-787
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-19T19:56:39.199Z

Reserved: 2026-07-24T06:39:54.180Z

Link: CVE-2026-16914

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T20:17:11.333

Modified: 2026-08-19T20:17:11.333

Link: CVE-2026-16914

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T23:15:05Z

Weaknesses