CVE-2026-19437 is a high severity buffer overflow (CVSS 8.1) in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1. A remote attacker could execute arbitrary code, though the attack is rated high complexity. IBM bulletin 7283858 lists the fixed service packs and fix packs.
What's affected
The record lists IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1. IBM delivers fixes in cumulative service packs and fix packs and adds notes for NIM installs and for VIOS 4.1.0 and 4.1.1.
How to check if you're exposed
On AIX:
oslevel -s
On VIOS, in the padmin shell:
ioslevel
Compare with the bulletin.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Record the level of each AIX and VIOS host.
- Apply the bulletin's fixes in one planned window.
- Follow the NIM and VIOS notes in the bulletin.
- Verify the level after the update.
Why it matters
The class is CWE-787, out-of-bounds write. Code writes data beyond a buffer, which corrupts memory and may allow code execution. The record rates attack complexity as high, which lowers the odds of reliable abuse, but the outcome is full compromise of the host.
This is one of several AIX and VIOS flaws in the same IBM bulletin, including CVE-2026-18832. Patching once covers them. The CVE is not in CISA's KEV list.
Quick check
Why is the score lower than CVE-2026-18832?
The vector here has high attack complexity and a network vector with no adjacency, per the record.
Do I patch separately?
No. IBM delivers these in the same bulletin.
Sources
Last reviewed: 19 October 2026.
