CVE-2026-18828 is a medium severity (CVSS 5.4) stack-based buffer overflow in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 that can cause denial of service for an attacker on an adjacent network. IBM delivers fixes through service packs and fix packs in bulletin 7283858 and lists no workaround.
What's affected
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 are affected. IBM's bulletin 7283858 is shared by several AIX and VIOS CVEs and says fixes are delivered as service packs and fix packs inside cumulative maintenance packages. The text we could read did not state the exact fix level for this CVE, and the bulletin has special steps for applying updates through NIM and extra steps after VIOS 4.1.0 and 4.1.1 updates. Read the Remediation and Fixes section of the bulletin for the level that applies to your system rather than relying on a number from this post.
IBM lists no workaround for this issue.
IBM's score is 5.4 with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, the same as the record. The vector is adjacent network, so the attacker must share a network segment with the target. The record's text says remote attacker, the vector says adjacent. Take the vector as the more precise statement.
How to check if you're exposed
Find the technology level and service pack of each LPAR. On AIX, run:
oslevel -s
On a VIOS, sign in as padmin and run:
ioslevel
Compare the result with the fixed levels in the Remediation section of IBM's bulletin. If you use NIM, list the clients and their levels from the NIM master so you can plan the update in one pass.
Then check which segments your LPARs and VIOS share with less trusted hosts, since the vector needs adjacency.
What to do now
- Collect the AIX and VIOS levels for all LPARs.
- Find the fix level for this CVE in the Remediation section of bulletin 7283858.
- Apply the service pack or fix pack following IBM's NIM and VIOS notes.
- Keep management and storage networks separate from general user networks.
- Check system logs for repeated crashes of network services.
Why it matters
The weakness class is CWE-787, an out-of-bounds write. A stack buffer is written past its end when data is longer than the code expects. Here the documented result is denial of service, with low confidentiality and availability impact, and no integrity impact.
Adjacent attackers are fewer than remote ones, so the score stays medium. But a crash of a service on VIOS can affect the client partitions that depend on it, so the practical effect depends on what the service does in your design. KEV status is false and IBM does not state that the flaw is exploited.
Quick check
Is this remote or adjacent?
The description says remote, but the CVSS vector says adjacent network. The vector is the more precise detail.
What is the impact?
Denial of service with limited confidentiality exposure, per IBM's vector.
Sources
Last reviewed: 18 October 2026.
