CVE-2026-17422: Critical Buffer Overflow in IBM AIX and VIOS

CVE-2026-17422 is a buffer overflow in IBM AIX 7.2, AIX 7.3 and PowerVM VIOS 4.1 that lets a local attacker execute arbitrary code. It scores 9.3, Critical, with changed scope. IBM shipped the fix in cumulative Service Packs and VIOS Fix Packs from 14 August 2026 and lists no workaround.

What's affected

AIX 7.2, AIX 7.3 and PowerVM VIOS 4.1 are listed. IBM's bulletin ties the fix to the bos.mp64 fileset and gives these affected ranges:

• AIX 7.2.5: 7.2.5.0 through 7.2.5.212
• AIX 7.3.2: 7.3.2.0 through 7.3.2.5
• AIX 7.3.3: 7.3.3.0 through 7.3.3.2
• AIX 7.3.4: 7.3.4.0 through 7.3.4.1

The fixes ship as cumulative Service Packs and Fix Packs: AIX 7.2 TL05 SP13, AIX 7.3 TL02 SP5, AIX 7.3 TL03 SP3, AIX 7.3 TL04 SP2, and VIOS Fix Packs 4.1.0.50, 4.1.1.30 and 4.1.2.20. IBM says these packs include fixes for all earlier published AIX and VIOS security issues and can be applied on top of any earlier affected level of the technology level.

The record scores it 9.3 (Critical) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The vector is local access with no privileges and no user interaction, with changed scope. IBM's bulletin gives the same score.

How to check if you're exposed

IBM points to the lslpp command for finding out whether the affected fileset is installed. Run these on each LPAR.

oslevel -s
lslpp -L | grep -i bos.mp64
instfix -ik IJ59565

Compare the bos.mp64 level with the ranges above. The instfix line checks for one APAR; use the APAR for your level from the table in the next section. On a VIOS, use ioslevel to read the Fix Pack level and compare it with 4.1.0.50, 4.1.1.30 or 4.1.2.20.

What to do now

1. Inventory every AIX 7.2, AIX 7.3 and VIOS 4.1 LPAR and record its level with oslevel -s or ioslevel.
2. Pick the target from IBM's table: AIX 7.2.5 needs APAR IJ59566 (SP13), 7.3.2 needs IJ59565 (SP05), 7.3.3 needs IJ59564 (SP03), 7.3.4 needs IJ59563 (SP02). On VIOS, 4.1.0 uses IJ59565 (4.1.0.50), 4.1.1 uses IJ59564 (4.1.1.30) and 4.1.2 uses IJ59563 (4.1.2.20).
3. Download the Service Pack or Fix Pack from IBM Fix Central and test it in a non-production LPAR first, as IBM advises.
4. Read the special notes before you start. Applying patches through NIM with nimsh secure needs extra steps because the protocol between master and client was made more secure (IBM node 7283157). On VIOS 4.1.0 and 4.1.1, extra steps are needed to migrate to Postgres15 after the update.
5. Plan the reboot. IBM says an LPAR reboot is needed to complete the update, and that AIX Live Update can avoid it.
6. IBM lists no workaround, so until you patch, limit local logins on these systems to people who need them.

Why it matters

The record classes the weakness as CWE-787, Out-of-bounds Write. The word local deserves a careful reading. The vector, AV:L and PR:N, says the attacker must be able to run something on the machine but does not need an account with special rights. On AIX that can mean anyone who reaches a shell or a job-running service, including through a different weakness that gives limited access first.

A buffer overflow of this class is out-of-bounds memory writing. When the data written is attacker-controlled, the result can be code running with the privileges of the vulnerable program. The changed-scope flag is what pushes the score to 9.3: a successful attack is rated as affecting resources beyond the component that was attacked.

For a Power estate, the practical risk is shared hosts. Multi-tenant LPARs, build servers and systems where several teams have shell accounts are the ones where local-only bugs behave like remote ones. The same IBM bulletin carries a companion issue, CVE-2026-17168, a remote authenticated stack overflow rated 8.5, so most teams will patch both in one change window. Neither the record nor the bulletin reports exploitation, and the CVE is not in the CISA catalog.

Quick check

Sources

• IBM Security Bulletin 7283858: AIX and PowerVM VIOS, fetched 18 October 2026

Last reviewed: 18 October 2026.