Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service.
Published: 2026-08-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack memory corruption flaw exists in the AIX IPsec ESP decapsulation handler for IBM AIX 7.2, AIX 7.3 and IBM PowerVM VIOS 4.1. An attacker who can trigger this behavior may overwrite kernel stack state, causing a crash of the operating system and resulting in a denial‑of‑service condition. The flaw is a classic heap or stack overflow leading to loss of availability.

Affected Systems

The vulnerability affects IBM AIX versions 7.2 and 7.3 as well as the IBM PowerVM VIOS 4.1 platform. AIX service packs and VIOS fix packs identified by IBM contain the necessary corrections.

Risk and Exploitability

The CVSS score of 6.5 places this change in the medium severity range. The EPSS score is not available, so the likelihood of exploitation cannot be precisely quantified, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the most likely attack vector is remote traffic: a specially crafted IPsec ESP packet sent to the vulnerable host. No public exploitation code has been reported, but the impact of a successful attack is a complete service interruption.

Generated by OpenCVE AI on August 21, 2026 at 00:05 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Download the appropriate IBM AIX Service Pack (e.g., AIX 7.3 TL04 SP2, AIX 7.2 TL05 SP13) or VIOS Fix Pack (VIOS 4.1.2 4.1.2.20) from Fix Central and apply the patch collection, following IBM’s instructions for a clean installation.
  • For AIX, use Live Update to apply the patch without reboot; otherwise, perform an LPAR reboot after installing the SP/FP to complete the update. For VIOS, an LPAR reboot is required.
  • After applying the VIOS 4.1.0 4.1.0.50 or VIOS 4.1.1 4.1.1.30 fix pack, follow IBM’s Postgres 15 migration guides linked in the reference article to complete the update and ensure database compatibility.

Generated by OpenCVE AI on August 21, 2026 at 00:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Ibm vios
CPEs cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*
Vendors & Products Ibm vios

Fri, 21 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm powervm Vios
Weaknesses CWE-908
CPEs cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm powervm Vios
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Ibm Aix Powervm Vios Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-21T13:52:49.838Z

Reserved: 2026-08-10T13:43:32.889Z

Link: CVE-2026-19448

cve-icon Vulnrichment

Updated: 2026-08-21T13:52:44.940Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-20T22:17:18.440

Modified: 2026-08-25T18:50:08.360

Link: CVE-2026-19448

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T00:30:07Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource