IBM AIX CVE-2026-18822

Exploitation requires local authenticated access to the target system with high-privilege credentials, as confirmed by the CVSS vector (AV:L/PR:H). The attacker must be able to supply crafted directory records to the parsing component - this implies at minimum filesystem or administrative access sufficient to influence the data being parsed. There is no network-based exploitation path. Exploitation is limited to: users with high-privileged local accounts on AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1; ability to present or trigger parsing of manipulated directory record data; and physical or SSH-based local session access. The high privilege requirement (PR:H) is the primary limiting factor: this is not exploitable by unprivileged or guest users, substantially narrowing the realistic attacker population.

The CVSS base score of 4.4 (Medium) accurately reflects a constrained risk profile: attack vector is local (AV:L), complexity is low (AC:L), but high privileges are required (PR:H), and scope is unchanged (S:U) with only availability impact (A:H). No EPSS data was provided in the source intelligence, so probability-of-exploitation estimates cannot be quantified independently. The CVE does not appear in the CISA KEV catalog, and no public proof-of-concept code has been identified. The combination of required local access and high-privilege credentials means this vulnerability is unlikely to be exploited opportunistically - it realistically targets an insider threat or a post-compromise lateral movement scenario. The most significant concern is the VIOS context: a DoS on the Virtual I/O Server can disrupt I/O services for all dependent LPARs, multiplying the blast radius beyond a single system. Even so, an organization would need to weigh this against the substantial access barrier before elevating response priority.

A local attacker with high-privileged access on an IBM AIX or PowerVM VIOS 4.1 system crafts or manipulates directory records presented to the vulnerable parsing component, triggering unbounded resource consumption. System memory or CPU is progressively exhausted, leading to a denial of service - on a VIOS partition, this could disrupt I/O availability for all dependent client LPARs. No public exploit code has been identified at time of analysis.