IBM AIX CVE-2026-18842

Exploitation requires an existing local session on the target system with at least low-privilege (non-root) user access, consistent with CVSS PR:L. The CVSS attack vector is local (AV:L), meaning remote unauthenticated exploitation is not possible - the attacker must have the ability to execute code on the system, such as through a shell login, a compromised service account, or a cron-executed script. No specific non-default configuration setting or product feature is identified in the description as a prerequisite; the flaw appears present in base installations of affected versions. Exploitation is limited by: (1) requirement for prior local access, (2) SSVC automatable=no indicating the attack cannot be easily scripted at scale across multiple targets, and (3) scope is unchanged (S:U), meaning the impact is confined to the compromised host and does not directly cascade to adjacent systems.

Despite a CVSS base score of 7.8 and SSVC technical impact rated as total, the overall real-world risk is moderated significantly by the local-only attack vector (AV:L). An attacker must already have an interactive or scripted foothold on the target system as a low-privileged user - remote unauthenticated exploitation is not possible. The EPSS score of 0.17% (6th percentile) corroborates the SSVC finding of exploitation status none, indicating that the security community has not observed active exploitation attempts. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified. The SSVC automatable flag is set to no, further reducing the likelihood of broad opportunistic exploitation. The high C/I/A impact metrics in CVSS are credible given that out-of-bounds writes can enable full privilege escalation on the vulnerable host, but these impacts only materialize after local access is obtained. In summary, this is a genuine post-compromise escalation risk for environments running IBM AIX or PowerVM VIOS - not an initial-access vector - and should be prioritized for patching during normal maintenance cycles rather than treated as an emergency.

An attacker who has obtained a low-privileged shell on an IBM AIX 7.3 system - for example, via a compromised application account - crafts input or triggers a code path that causes the vulnerable component to write beyond its allocated buffer. The out-of-bounds write corrupts adjacent kernel memory structures, allowing the attacker to redirect execution or modify credential structures to gain root-level access. No public proof-of-concept is known at time of analysis, but the standard-complexity (AC:L) CVSS rating suggests exploitation does not require unusual preconditions beyond local access.