IBM AIX CVE-2026-16945

Exploitation requires a local user account with at minimum standard (low) privileges on the affected IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system, as confirmed by CVSS PR:L and AV:L. No user interaction from a privileged user is required (UI:N), and no special non-default configuration is described as a prerequisite - the vulnerable code path appears reachable by any authenticated local user. Limiting factors: remote unauthenticated exploitation is not possible; the attacker must have already established a local presence on the target system (physical, SSH, or LPAR access). The unchanged scope (S:U) indicates impact is confined to the vulnerable system itself rather than automatically propagating to adjacent LPARs or hypervisor layers, though VIOS compromise has inherent implications for hosted partitions.

CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the risk profile: local exploitation with low complexity and no user interaction, yielding full system control. The local attack vector (AV:L) meaningfully limits exposure compared to network-exploitable flaws - an attacker must first obtain a foothold on the system before exploiting this vulnerability. However, in multi-tenant IBM Power environments running multiple LPARs, a compromised guest partition with VIOS access could escalate impact beyond a single VM. No EPSS score was provided in the input data, so exploitation probability cannot be quantitatively stated. No KEV listing exists and no public exploit has been identified, indicating this is not under active widespread exploitation at time of analysis. For organizations running IBM AIX or PowerVM VIOS in critical infrastructure roles (financial services, banking, healthcare - common AIX verticals), this warrants prompt patching given the privilege escalation potential, even absent active exploitation.

An attacker who has obtained a low-privileged local account on an IBM AIX 7.3 or PowerVM VIOS 4.1 system - through credential theft, phishing, or as an insider - invokes a vulnerable binary or system call path that triggers the stack-based buffer overflow by supplying a crafted oversized input. By overwriting the stack return address with a controlled value, the attacker redirects execution to shellcode or a ROP chain, achieving arbitrary code execution at an elevated privilege level. No public exploit has been identified at time of analysis, but the low attack complexity rating (AC:L) suggests the overflow is straightforwardly triggerable without race conditions or heap grooming.