IBM AIX CVE-2026-16891

Exploitation requires an authenticated local session on the target IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system with at least low-privilege credentials, as confirmed by CVSS vector AV:L/PR:L. The attacker must have the ability to execute code or invoke the vulnerable component interactively - remote unauthenticated attackers cannot exploit this flaw. The specific subsystem, binary, or system call that triggers the out-of-bounds read is not disclosed in the available data. Exploitation is further limited by the low confidentiality impact (C:L), indicating partial rather than full memory disclosure, and by the absence of any integrity or availability impact (I:N/A:N). Non-default or special configuration requirements are not stated in the description, suggesting the flaw may be present in standard AIX/VIOS deployments, but this cannot be confirmed without the specific trigger being identified.

The CVSS 3.3 (Low) score is internally consistent with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - local-only access, low privilege threshold, no scope change, and limited confidentiality impact collectively constrain real-world risk. No EPSS data was provided, making exploitation probability quantification impossible from available inputs. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit code has been identified, reinforcing the low-urgency posture. The unchanged scope (S:U) means exploitation cannot pivot to adjacent systems or partitions directly, which is particularly relevant in PowerVM environments where lateral movement between logical partitions would be a higher concern. The primary realistic risk is information leakage within a shared AIX or VIOS environment where untrusted local accounts exist - a scenario more common in managed service or legacy enterprise deployments. Organizations with strict local access controls (single-purpose systems, no shared logins) can reasonably treat this as low urgency; those with broad local user populations should prioritize the vendor patch.

A low-privileged user with a local shell account on an IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system invokes a vulnerable system call, utility, or API that triggers an out-of-bounds read in an underlying buffer. The resulting memory disclosure exposes adjacent data - potentially including sensitive configuration values, in-memory credentials, or data belonging to other processes - which the attacker reads and exfiltrates. No public exploit code exists at time of analysis, so exploitation would require independent vulnerability research to identify the specific trigger.