CVE-2026-19448 is a medium severity (CVSS 6.5) stack memory corruption flaw in the IPsec ESP decapsulation handler of IBM AIX 7.2, AIX 7.3 and PowerVM VIOS 4.1. A successful attack can corrupt kernel stack state and crash the system. IBM ships the fix in its cumulative service packs, so apply the update named in its bulletin.
What's affected
IBM's bulletin and the NVD record agree on the affected products: IBM AIX 7.2, IBM AIX 7.3 and IBM PowerVM VIOS 4.1. The record scores the flaw 6.5 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H, which means it is reachable over the network, needs a hard to meet condition, and affects availability most.
The weakness is tracked as CWE-908 (use of uninitialized resource). The record does not list a KEV entry, and neither the record nor the IBM page we read says the flaw is exploited in the wild.
The bulletin says fixes are delivered through cumulative service packs and fix packs for supported releases, with extra notes for NIM and for VIOS 4.1.0 and 4.1.1 updates. The part of the page that lists exact APAR and fix level numbers was not available to us, so read the Remediation section of the IBM bulletin for the precise level for your release. We are not going to guess a version here.
How to check if you're exposed
Start with whether the host is on an affected release and whether it uses IPsec at all. On AIX, print the technology level and service pack:
oslevel -s
On a VIOS partition, from the padmin shell:
ioscli ioslevel
Compare the output with the fix levels in the IBM bulletin. Then list which systems terminate or pass IPsec tunnels. A host that does not process ESP traffic has a smaller exposure, though you should still patch on your normal cycle. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- List every AIX 7.2, AIX 7.3 and VIOS 4.1 system in your inventory, including lab and disaster recovery partitions.
- Open the IBM bulletin and find the fix level that applies to your release.
- Prioritise hosts that terminate IPsec tunnels or sit on untrusted network paths.
- Apply the service pack or fix pack through your normal change process. Follow the NIM and VIOS notes in the bulletin.
- Reboot as the update requires, then re-run the level commands above and record the result.
- Watch for unexplained kernel crashes on IPsec hosts before and after patching, since a crash is the described impact.
Why it matters
The record classes this as CWE-908 (use of uninitialized resource), and IBM describes it as stack memory corruption in the code that unpacks incoming ESP packets. Code that parses network input in the kernel gets very little room for error, because a mistake there takes down the whole machine rather than one process.
The score is moderate because the attack complexity is high and the stated outcome is a crash and a small integrity impact, not code execution. For a production AIX box that carries payments, batch jobs or a database, an outage still counts. Treat it as a scheduled patch, not a fire drill, unless the host faces untrusted networks.
Quick check
Does this flaw let an attacker run code?
IBM's description says successful exploitation may corrupt kernel stack state and cause a crash, resulting in denial of service. It does not claim code execution. Check the bulletin for any update to that wording.
Is it exploited in the wild?
The NVD record's KEV flag is false and the IBM page we read does not say it is exploited. That can change, so recheck the bulletin and the CISA catalog.
Sources
Last reviewed: 18 October 2026.
