Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.
Published: 2026-08-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An integer overflow during size computation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 allows a remote attacker to execute arbitrary code. The flaw can corrupt memory or hijack control flow, giving the attacker full compromise of the affected host. The weakness corresponds to CWE‑190 Integer Overflow or Underflow.

Affected Systems

The vulnerability affects IBM AIX 7.2 and 7.3 series and IBM PowerVM VIOS 4.1. The specific affected releases include AIX 7.2.0 through 7.2 TL05 SP13, AIX 7.3 0 through 7.3 TL04 SP2, and VIOS 4.1.0, 4.1.1 and 4.1.2 with their respective fix‑pack levels up to 4.1.2.20. These systems run on IBM Power servers.

Risk and Exploitability

The CVSS score of 9.8 indicates that exploitation is highly damaging and can be achieved remotely. EPSS is not available, and the flaw is not listed in CISA KEV, but the high severity and lack of prerequisite privileges mean that anyone with network access could trigger the overflow. An LPAR reboot is required to complete the SP/FP update unless Live Update is used on AIX. Immediate patching is essential to prevent remote code execution.

Generated by OpenCVE AI on August 20, 2026 at 23:37 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Download and apply the appropriate AIX Service Pack or VIOS Fix Pack from IBM Fix Central for the installed product version (e.g., AIX SPs: 7.3 TL04 SP2, 7.3 TL03 SP3, 7.3 TL02 SP5, 7.2 TL05 SP13; VIOS FPs: 4.1.2 4.1.2.20, 4.1.1 4.1.1.30, 4.1.0 4.1.0.50).
  • If the system uses LPAR, reboot the LPAR after the update to complete the installation; otherwise, use Live Update on AIX to avoid a reboot.
  • For PowerVM VIOS 4.1.0 or 4.1.1, follow the post‑update migration instructions to upgrade to Postgres15 as required (see IBM support articles).
  • Apply the nimsh secure special steps when installing patches to ensure the updated secure protocol between master and client is handled correctly (consult the IBM support article).

Generated by OpenCVE AI on August 20, 2026 at 23:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-190
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-22T03:56:16.158Z

Reserved: 2026-07-24T17:53:50.482Z

Link: CVE-2026-17160

cve-icon Vulnrichment

Updated: 2026-08-21T15:31:37.737Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-20T22:17:14.360

Modified: 2026-08-25T13:34:17.893

Link: CVE-2026-17160

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T00:00:05Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound