EUVD-2026-63742
GHSA-q2rp-77f6-p8cc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed IBM AIX or VIOS network service
-
DeliveryCraft oversized or malformed network payload
-
ExploitSend payload to vulnerable listener
-
ExecutionTrigger stack-based buffer overflow
-
PersistCrash target process or system
-
ImpactDeny service to legitimate operations
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS 3.1 vector (PR:N/UI:N/AV:N/AC:L) indicates remote unauthenticated exploitation with low attack complexity against affected IBM AIX 7.2, 7.3, or PowerVM VIOS 4.1 systems. The CVE description does not specify a particular service, port, protocol, or non-default configuration as a prerequisite. However, the SSVC designation of 'Automatable: no' contradicts the low-complexity, no-auth CVSS vector, suggesting an undisclosed constraint - possibly a specific protocol state, version-dependent code path, or service that must be listening - that prevents trivial mass exploitation. The specific network service responsible for the overflow is not identified in available data; defenders should consult the IBM advisory to identify which service to isolate. Exploitation is limited to systems running the affected AIX or VIOS versions and results only in denial of service, with no confidentiality or integrity impact. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) presents this as a straightforward, unauthenticated remote crash - a high-severity rating reflecting availability loss. However, several signals moderate the urgency. The EPSS score of 0.29% places this in only the 21st percentile of exploitation likelihood, far below the threshold typically associated with opportunistic mass exploitation. The SSVC assessment reinforces this: exploitation status is 'none', automatable is 'no' (in tension with the AV:N/AC:L/PR:N/UI:N vector - this discrepancy is unexplained and warrants vendor clarification), and technical impact is only 'partial'. There is no CISA KEV listing and no public proof-of-concept identified. Taken together, the realistic threat picture is of a difficult-to-trigger remote DoS requiring some unknown network-level precondition that the SSVC automation flag implies, rather than a trivially scripted internet-scale attack. For IBM POWER environments running AIX in critical roles - infrastructure, financial systems, or industrial control - availability loss from a crash remains a meaningful operational risk even without active exploitation. |
| Exploit ScenarioDerived | A remote attacker with network access to an affected IBM AIX or VIOS system sends a specially crafted network request that triggers the stack-based buffer overflow in a listening service or protocol handler. The overflow corrupts stack memory, causing the targeted process or system to crash, denying service to legitimate users or halting virtualized I/O operations in a VIOS environment. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 25, 2026
Stack-based buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows remote unauthenticated attackers to crash affected systems, producing a denial of service. The CVSS 3.1 vector scores this at 7.5 High with no authentication or user interaction required, targeting availability exclusively. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low real-world exploitation probability at time of analysis.
Earlier versions of this analysis (1)
Stack-based buffer overflow in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables adjacent-network attackers to trigger denial-of-service conditions and read limited stack memory contents without authentication. The CWE-787 out-of-bounds write in a network-facing component can be triggered by a crafted payload from a co-located attacker, producing both an availability disruption and a low-severity confidentiality exposure as reflected by the CVSS C:L metric. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity (AC:L, UI:N) lowers the exploitation barrier once an attacker achieves network adjacency.
RemediationAI
Consult and apply guidance from the IBM security advisory at https://www.ibm.com/support/pages/node/7283858. No specific patched version number is provided in the available intelligence data, so a precise target upgrade version cannot be independently confirmed - the advisory should be treated as the definitive source for fix versions. Until patching is complete, consider restricting network access to the affected AIX and VIOS systems using perimeter firewall rules or network segmentation, limiting exposure of the vulnerable network service to trusted hosts only. Note that network segmentation reduces attack surface but does not eliminate the vulnerability for environments with legitimate remote access requirements. If the vulnerable service can be identified and disabled without operational impact, that represents a more complete interim control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM AIX is IBM's proprietary UNIX operating system designed for POWER-series hardware, and IBM PowerVM VIOS (Virtual I/O Server) is a specialized AIX-based partition that provides shared I/O resources to other logical partitions on POWER systems. CWE-787 (Out-of-Bounds Write) identifies the root cause as a stack-based buffer overflow - a condition where a network-supplied input exceeds the bounds of a stack-allocated buffer, overwriting adjacent stack memory. In a denial-of-service context, this typically causes a process or kernel crash rather than code execution, though stack overflows of this class can sometimes be escalated. Affected CPE entries span multiple version ranges of both cpe:2.3:o:ibm:aix and cpe:2.3:a:ibm:vios, indicating broad coverage across the AIX 7.2 and 7.3 release families and VIOS 4.1.
Know when Aix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated network crash with no confidentiality or integrity impact; SSVC 'Automatable: no' noted but insufficient data to elevate AC beyond L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.
Executive ViewAI
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 contain a remote denial-of-service vulnerability (CVE-2026-18828) accessible without authentication that could disrupt affected systems. Although CISA has not confirmed active exploitation and real-world attack probability is low at 0.3% EPSS, availability impact to these enterprise infrastructure platforms warrants immediate inventory and mitigation planning, particularly for business-critical deployments.
No vendor-released patch identified at time of analysis. Deploy interim mitigations: restrict network access via firewall rules and network segmentation; implement connection logging and alerting on affected systems; disable unnecessary remote services where operationally feasible; apply rate limiting on management interfaces; maintain detailed inventory for rapid response; prepare staging environment to test patch deployment when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Exploit-DB