CVE-2026-18670: Integer Underflow in IBM AIX and PowerVM VIOS

CVE-2026-18670 is a high severity integer underflow (CVSS 8.2) in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1. A remote attacker could cause a denial of service and possibly disclose sensitive information. IBM's bulletin 7283858 delivers the fix through service packs and fix packs.

What's affected

Per the record: IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1. IBM's bulletin says the fixes come in cumulative service packs and fix packs, and that special steps apply when using NIM to install them. The bulletin also mentions extra steps after applying VIOS 4.1.0 or 4.1.1 updates.

How to check if you're exposed

Show the exact AIX level on each host:

oslevel -s

On a VIOS, use the padmin shell:

ioslevel

Compare the results with the levels in the bulletin.

Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.

What to do now

1. Collect the oslevel or ioslevel from every AIX and VIOS host.
2. Read IBM's bulletin, including the NIM and VIOS notes.
3. Apply the service pack or fix pack for each release in a maintenance window.
4. Verify the new level afterward and restrict network access to services on these hosts.

Why it matters

Integer underflow, CWE-191, along with CWE-190, integer overflow, is a class where arithmetic wraps around and produces a value the code did not expect, such as a huge length. That can lead to crashes or reads of memory that should be off limits, which matches the denial of service and information disclosure in the record.

IBM bundles several AIX and VIOS flaws in one bulletin, including CVE-2026-18716, CVE-2026-18832 and CVE-2026-19437. One patch cycle covers all of them. The CVE is not in CISA's KEV list.

Quick check

Sources

• IBM AIX and VIOS security bulletin

Last reviewed: 19 October 2026.