Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
Published: 2026-08-20
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stack-based buffer overflow that allows a remote authenticated attacker to execute arbitrary code on affected systems. This flaw can compromise confidentiality, integrity, and availability by giving the attacker control over the processor. It is identified as CWE-787, a classic memory corruption weakness.

Affected Systems

IBM AIX versions 7.2 and 7.3, specifically the platforms listed in the cpes, and IBM PowerVM VIOS 4.1 and its subversions 4.1.0, 4.1.1, and 4.1.2. The vendor recommends applying Service Packs and Fix Packs that include the fix: for AIX, AIX 7.3 TL04 SP2, AIX 7.3 TL03 SP3, AIX 7.3 TL02 SP5, and AIX 7.2 TL05 SP13; for VIOS, VIOS 4.1.2 4.1.2.20, VIOS 4.1.1 4.1.1.30, and VIOS 4.1.0 4.1.0.50.

Risk and Exploitability

The CVSS score of 8.5 reflects high severity. EPSS data is not available, but the flaw requires remote authenticated access; once compromised, an attacker can gain full control of the host. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of public exploitation data does not reduce the need for remediation. Application of the specified patches eliminates the flaw and removes the attack surface.

Generated by OpenCVE AI on August 20, 2026 at 23:35 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Apply the latest AIX Service Pack (e.g., AIX 7.3 TL04 SP2 or the equivalent for earlier tiers) and the corresponding VIOS Fix Pack (e.g., VIOS 4.1.2 4.1.2.20) through IBM Fix Central.
  • On AIX, use Live Update to apply the Service Pack or Fix Pack without rebooting; if Live Update is not used, perform an LPAR reboot after installation.
  • When applying patches with nimsh secure, follow IBM’s updated protocol guidelines to ensure the master–client communication remains secure.
  • For VIOS 4.1.0 and 4.1.1, after updating to the referenced Fix Packs, execute the Postgres15 migration steps as detailed in IBM’s documentation for those specific versions.

Generated by OpenCVE AI on August 20, 2026 at 23:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-787
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Aix Powervm Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-20T21:56:34.694Z

Reserved: 2026-07-24T18:05:41.033Z

Link: CVE-2026-17168

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T22:17:14.890

Modified: 2026-08-20T22:17:14.890

Link: CVE-2026-17168

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T00:30:07Z

Weaknesses