CVE-2026-18716 is a high severity out-of-bounds read (CVSS 7.9) in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1. A remote authenticated attacker could read sensitive information or cause a denial of service. Apply the service pack or fix pack named in IBM bulletin 7283858.
What's affected
The record lists IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. Fixes arrive in cumulative service packs and fix packs. IBM notes special steps for NIM based installs and extra steps after VIOS 4.1.0 and 4.1.1 updates.
How to check if you're exposed
On AIX, print the level:
oslevel -s
On VIOS, from the padmin shell:
ioslevel
Then compare against the bulletin.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Gather the level of every AIX and VIOS host.
- Plan one maintenance window for the whole bulletin, since it covers several CVEs.
- Follow IBM's NIM and VIOS notes during the update.
- Confirm the new level after installation.
Why it matters
An out-of-bounds read, CWE-125, means code reads past the end of a buffer. The result may be a crash or leaked memory contents. The record gives a changed scope and an attacker who must already be authenticated, so the main exposure is on systems with many users or exposed services.
This CVE shares its bulletin with CVE-2026-18670 and others, so patch them together. The CVE is not in CISA's KEV list.
Quick check
Does the attacker need a login?
Yes, the record says remote authenticated.
Is it fixed by the same patch as CVE-2026-18670?
Both are in IBM bulletin 7283858, so the same release cycle applies. Confirm in the bulletin.
Sources
Last reviewed: 19 October 2026.
