IBM AIX CVE-2026-19783

The attacker must have an authenticated local shell session on the affected AIX 7.2/7.3 or VIOS 4.1 system with at minimum low-privilege user rights (confirmed by PR:L in the CVSS vector). Exploitation requires the ability to cause the AIX kernel to process a crafted filesystem image during directory read operations - concretely, this means the attacker must be able to mount a filesystem, supply a filesystem image to a kernel-accessible path, or otherwise trigger the vulnerable directory-read code path with attacker-controlled data. Remote exploitation is not possible (AV:L confirmed); the flaw cannot be triggered over a network without prior local access. The attack is not automatable per SSVC, consistent with the need for deliberate local interaction. Exploitation is further limited by requiring meaningful kernel internals knowledge to achieve reliable privilege escalation rather than a simple crash, though the crash path (denial of service) is more straightforward. Environments where local shell access is restricted to trusted administrators only are substantially less exposed.

The CVSS 7.8 High score is consistent with a local privilege escalation to full kernel control (C:H/I:H/A:H), but the local attack vector (AV:L) and low-privilege requirement (PR:L) significantly constrain real-world exposure compared to network-facing vulnerabilities. EPSS at 0.16% in the 6th percentile reflects very low observed exploitation probability, consistent with the local-only vector and the relatively niche IBM Power/AIX deployment footprint. SSVC confirms exploitation status as none and the flaw is not automatable - both signals corroborate the absence of active exploitation. Critically, SSVC rates technical impact as total, meaning a successful exploit grants complete system compromise. This discrepancy between low EPSS and total SSVC impact is not conflicting: the low EPSS reflects that exploitation at scale is difficult, while total impact reflects what happens if exploitation succeeds in targeted scenarios. The primary risk surface is multi-tenant or shared IBM Power environments - HPC clusters, financial systems, VIOS-managed virtualization hosts - where untrusted local users could mount or induce processing of arbitrary filesystem images. This is not a broad-internet priority but warrants prompt patching in environments with shared AIX login access.

A low-privilege user with local shell access on an IBM AIX 7.3 system crafts a filesystem image containing malformed directory entries engineered to overflow a kernel-stack buffer when the AIX kernel processes directory reads. The attacker mounts or otherwise causes the kernel to parse this image, triggering an out-of-bounds write that either panics the kernel (denial of service) or, with precise memory layout knowledge, overwrites a kernel return address to execute arbitrary code at ring-0 and escalate to root. No public exploit code has been identified at time of analysis, so exploitation currently requires significant kernel internals expertise.