CVE-2026-16847: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20 - Configuration
On AIX, if available, use Live Update to avoid a reboot (noting an LPAR reboot is required to complete the SP/FP update per the post-update requirement).
IBM AIX Live Update Live Update enablement = use Live Update to avoid a reboot - Operational
After applying the AIX Service Pack (SP) and VIOS Fix Pack (FP) updates, perform an LPAR reboot to complete the SP/FP update.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, after applying the VIOS 4.1.0.50 or VIOS 4.1.1.30 FPs, complete the additional steps required to migrate to the latest Postgres15.
Event History
Frequently Asked Questions
Which systems should be prioritized for assessment?
Systems running IBM AIX or IBM PowerVM VIOS should be assessed, particularly where they are reachable by remote attackers.
What is the potential impact of successful exploitation?
A remote attacker could execute arbitrary code by exploiting the heap buffer overflow.