CVE-2026-18840 is a high severity (CVSS 8.2) flaw in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. Improper validation of an attacker-controlled pointer lets a local attacker execute arbitrary code. IBM delivers fixes through service packs and fix packs in bulletin 7283858 and lists no workaround.
What's affected
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 are affected. IBM's bulletin 7283858 is shared by several AIX and VIOS CVEs and says fixes are delivered as service packs and fix packs inside cumulative maintenance packages. The text we could read did not state the exact fix level for this CVE, and the bulletin has special steps for applying updates through NIM and extra steps after VIOS 4.1.0 and 4.1.1 updates. Read the Remediation and Fixes section of the bulletin for the level that applies to your system rather than relying on a number from this post.
IBM lists no workaround for this issue.
IBM's score is 8.2 with the vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The attack is local and needs high privileges, but the scope is changed, which is why the impacts are high.
How to check if you're exposed
Find the technology level and service pack of each LPAR. On AIX, run:
oslevel -s
On a VIOS, sign in as padmin and run:
ioslevel
Compare the result with the fixed levels in the Remediation section of IBM's bulletin. If you use NIM, list the clients and their levels from the NIM master so you can plan the update in one pass.
Then review who has local shell access with the privileges the vector assumes. On VIOS, review who uses the padmin account.
What to do now
- Collect the AIX and VIOS levels for all LPARs.
- Find the fix level in the Remediation section of bulletin 7283858.
- Apply the service pack or fix pack following IBM's notes.
- Review and reduce the list of accounts with administrative or root level access.
- Verify the level after the update.
Why it matters
The weakness class is CWE-822, untrusted pointer dereference. A component receives a pointer value from a source it should not trust, and uses it without checking that it points where it should. When the attacker controls the address, the component may read or write memory of the attacker's choosing, and from there run code.
The change of scope in the score suggests that code run in a privileged component can affect things beyond that component, such as the kernel or other partitions that depend on it. The need for high privileges and local access limits who can try. KEV is false.
Quick check
Can this be used remotely?
No. IBM's vector is local and requires high privileges.
Why a changed scope?
Code running in the affected component can impact resources outside its own security boundary, according to the scoring.
Sources
Last reviewed: 18 October 2026.
