CVE-2026-18828: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50Patch key_w_apar7.3.2IJ5956508/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30Patch key_w_apar7.3.3IJ5956408/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20Patch key_w_apar7.3.4IJ59563 - Compensating control
If applying these patches using nimsh secure: take the special steps noted in the material because the protocol between master and client is updated to be more secure.
- Operational
Perform an LPAR reboot to complete the SP/FP update for the AIX Service Pack / VIOS Fix Pack update (explicitly required in the post-update instructions).
- Operational
If running VIOS 4.1.0 or VIOS 4.1.1: complete the additional steps required to migrate to the latest Postgres15 after applying the 4.1.0.50 or 4.1.1.30 FPs.
Event History
Frequently Asked Questions
Which systems are identified as affected?
The affected software listed is IBM AIX and IBM PowerVM VIOS.
What is the reported impact of successful exploitation?
A remote attacker could cause a denial of service through a stack-based buffer overflow.