CVE-2026-17168: High Stack Overflow in IBM AIX and VIOS

CVE-2026-17168 is a stack-based buffer overflow in IBM AIX 7.2, AIX 7.3 and PowerVM VIOS 4.1. It rates 8.5, High, and lets a remote authenticated attacker run arbitrary code. IBM fixes it through cumulative Service Packs and VIOS Fix Packs that became available on 14 August 2026, with no workaround offered.

What's affected

AIX 7.2, AIX 7.3 and PowerVM VIOS 4.1 are listed. IBM's bulletin ties the fix to the bos.mp64 fileset and gives these affected ranges:

• AIX 7.2.5: 7.2.5.0 through 7.2.5.212
• AIX 7.3.2: 7.3.2.0 through 7.3.2.5
• AIX 7.3.3: 7.3.3.0 through 7.3.3.2
• AIX 7.3.4: 7.3.4.0 through 7.3.4.1

The fixes ship as cumulative Service Packs and Fix Packs: AIX 7.2 TL05 SP13, AIX 7.3 TL02 SP5, AIX 7.3 TL03 SP3, AIX 7.3 TL04 SP2, and VIOS Fix Packs 4.1.0.50, 4.1.1.30 and 4.1.2.20. IBM says these packs include fixes for all earlier published AIX and VIOS security issues and can be applied on top of any earlier affected level of the technology level.

The record scores it 8.5 (High) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector shows network access, high attack complexity and low privileges, with changed scope. IBM's bulletin and the NVD record give the same score, so there is no conflict to flag.

How to check if you're exposed

IBM points to the lslpp command for finding out whether the affected fileset is installed. Run these on each LPAR.

oslevel -s
lslpp -L | grep -i bos.mp64
instfix -ik IJ59565

Compare the bos.mp64 level with the ranges above. The instfix line checks for one APAR; use the APAR for your level from the table in the next section. On a VIOS, use ioslevel to read the Fix Pack level and compare it with 4.1.0.50, 4.1.1.30 or 4.1.2.20.

What to do now

1. Inventory every AIX 7.2, AIX 7.3 and VIOS 4.1 LPAR and record its level with oslevel -s or ioslevel.
2. Pick the target from IBM's table: AIX 7.2.5 needs APAR IJ59566 (SP13), 7.3.2 needs IJ59565 (SP05), 7.3.3 needs IJ59564 (SP03), 7.3.4 needs IJ59563 (SP02). On VIOS, 4.1.0 uses IJ59565 (4.1.0.50), 4.1.1 uses IJ59564 (4.1.1.30) and 4.1.2 uses IJ59563 (4.1.2.20).
3. Download the Service Pack or Fix Pack from IBM Fix Central and test it in a non-production LPAR first, as IBM advises.
4. Read the special notes before you start. Applying patches through NIM with nimsh secure needs extra steps because the protocol between master and client was made more secure (IBM node 7283157). On VIOS 4.1.0 and 4.1.1, extra steps are needed to migrate to Postgres15 after the update.
5. Plan the reboot. IBM says an LPAR reboot is needed to complete the update, and that AIX Live Update can avoid it.
6. IBM lists no workaround. Until you patch, the practical lever is limiting who can log in to these systems.

Why it matters

The record classes the weakness as CWE-787, Out-of-bounds Write. A stack-based overflow happens when a program copies more data into a fixed-size buffer on the stack than the buffer can hold. The extra bytes overwrite neighbouring memory, and in the worst case that lets an attacker steer what the process runs next. IBM's wording is deliberately short: a remote authenticated attacker could execute arbitrary code.

The score is held below 9 by two things in the vector. The attacker needs a valid account, and attack complexity is rated high. But the scope is marked as changed, which means the impact can reach beyond the vulnerable component. On a server that hosts many users or applications, that matters.

This bulletin is large. It covers a long list of AIX and VIOS issues, including another buffer overflow, CVE-2026-17422, that is local rather than remote. IBM bundled the fixes into cumulative packs, so patching one CVE means you take them all. That is convenient, but it also means the change is bigger than a single fix, which is why IBM stresses testing. Nothing in the record or the bulletin says this CVE is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.

Quick check

Sources

• IBM Security Bulletin 7283858: AIX and PowerVM VIOS, fetched 18 October 2026

Last reviewed: 18 October 2026.