CVE-2026-18842 is a high severity (CVSS 8.4) out-of-bounds write in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 that lets a local attacker gain elevated privileges. IBM delivers fixes through service packs and fix packs in bulletin 7283858 and lists no workaround.
What's affected
IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 are affected. IBM's bulletin 7283858 is shared by several AIX and VIOS CVEs and says fixes are delivered as service packs and fix packs inside cumulative maintenance packages. The text we could read did not state the exact fix level for this CVE, and the bulletin has special steps for applying updates through NIM and extra steps after VIOS 4.1.0 and 4.1.1 updates. Read the Remediation and Fixes section of the bulletin for the level that applies to your system rather than relying on a number from this post.
IBM lists no workaround for this issue.
IBM's score is 8.4 with the vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack is local, needs no privileges and no user interaction, which makes it one to prioritize on shared systems.
How to check if you're exposed
Find the technology level and service pack of each LPAR. On AIX, run:
oslevel -s
On a VIOS, sign in as padmin and run:
ioslevel
Compare the result with the fixed levels in the Remediation section of IBM's bulletin. If you use NIM, list the clients and their levels from the NIM master so you can plan the update in one pass.
Then list the machines where untrusted or semi-trusted users can log in, such as shared development or application hosts. Those are where a local flaw with no privilege requirement matters most.
What to do now
- Collect the AIX and VIOS levels for all LPARs.
- Find the fix level in the Remediation section of bulletin 7283858.
- Apply the service pack or fix pack, following IBM's NIM and VIOS notes.
- Remove local accounts that are not needed, especially on shared hosts.
- Verify the level after the update and record it.
Why it matters
The weakness class is CWE-787, an out-of-bounds write. Memory is written beyond the intended boundary, and that can change data that controls privileges or execution. In an operating system component, a write like this is a classic route from a normal local account to full control.
The lack of any privilege requirement is the reason the score is 8.4 although the attack is local. Attackers who gain a foothold by other means, such as a stolen application login, can use local flaws to take over a host. The practical defense is prompt patching and limiting local accounts. KEV is false.
Quick check
Does the attacker need an account?
The vector says no privileges are required, but the attack is local, so the attacker needs to be able to run code on the host.
Where is the fix?
In the service packs and fix packs listed in IBM bulletin 7283858.
Sources
Last reviewed: 18 October 2026.
