Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
Published: 2026-08-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a stack‑based buffer overflow that permits a remote attacker to execute arbitrary code on affected IBM AIX and PowerVM VIOS systems. This vulnerability is identified as CWE‑121. Unauthorized code execution could compromise the confidentiality, integrity, and availability of the affected servers.

Affected Systems

The vulnerability affects IBM AIX releases 7.2 and 7.3 as well as the corresponding Technical Level updates: AIX 7.3 TL 04 SP 2, TL 03 SP 3, TL 02 SP 5, and 7.2 TL 05 SP 13. It also impacts IBM PowerVM VIOS 4.1.0, 4.1.1, and 4.1.2. The applicable Service Packs and Fix Packs include SP2 for AIX 7.3, SP3 for newer AIX 7.3 releases, SP5 for older 7.3, SP13 for AIX 7.2, and VIOS Fix Packs 4.1.0.50, 4.1.1.30, and 4.1.2.20.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that a public exploit has not been documented. However, the description explicitly states that a remote attacker can execute arbitrary code, meaning the attack vector is remote. The vulnerability is highly valuable to attackers because it allows full control over the affected systems. Prompt remediation by installing the listed Service Packs or Fix Packs is strongly recommended to mitigate the risk.

Generated by OpenCVE AI on August 20, 2026 at 23:42 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Download and apply the appropriate AIX Service Pack (e.g., SP2 for AIX 7.3 or SP13 for AIX 7.2) or PowerVM VIOS Fix Pack (e.g., 4.1.2.20 for VIOS 4.1.2) from IBM Fix Central.
  • For AIX, perform the update with Live Update to avoid a system reboot; otherwise reboot the LPAR after the Service Pack or Fix Pack installation to complete the update.
  • For VIOS 4.1.0 and 4.1.1, after installing the Fix Pack, follow IBM’s post‑update instructions to migrate to PostgreSQL 15 before the next restart.
  • When applying updates via nimsh secure, follow the special steps described in IBM’s article to ensure the secure protocol update is correctly handled.

Generated by OpenCVE AI on August 20, 2026 at 23:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-121
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-25T03:56:12.294Z

Reserved: 2026-07-24T17:06:35.053Z

Link: CVE-2026-17138

cve-icon Vulnrichment

Updated: 2026-08-21T15:28:03.277Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-20T22:17:13.187

Modified: 2026-08-25T13:51:00.070

Link: CVE-2026-17138

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T01:15:06Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow