CVE-2026-19783 is a medium severity (CVSS 6.7) kernel memory corruption flaw in IBM AIX 7.2, AIX 7.3 and PowerVM VIOS 4.1. A local attacker can use a crafted filesystem image to trigger an out-of-bounds kernel stack write during directory reads. The result is a crash or possibly privilege escalation. Patch per IBM's bulletin.
What's affected
The affected products are IBM AIX 7.2, IBM AIX 7.3 and IBM PowerVM VIOS 4.1. The record gives a score of 6.7 (Medium) and the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. That vector means the attacker needs local access and high privileges, which is why the score is not higher.
The weakness is CWE-787 (out-of-bounds write). The KEV flag in the record is false.
IBM says fixes are delivered through cumulative service packs and fix packs, with additional notes for NIM and for VIOS 4.1.0 and 4.1.1 updates. The page section with exact APAR and fix level numbers was not readable for us, so confirm the level for your release in the IBM bulletin. This bulletin covers more than one CVE, so patching for this one also addresses the IPsec issue CVE-2026-19448 when you take the listed fix.
How to check if you're exposed
Confirm the operating system level on each host:
oslevel -s
On VIOS, from padmin:
ioscli ioslevel
Then ask a second question: who can mount or supply a filesystem image on this machine? The weakness needs an attacker who can get a malformed image read by the kernel. Hosts where only trusted administrators handle filesystem images carry less practical risk than shared systems where several teams hold elevated rights. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Inventory AIX 7.2, AIX 7.3 and VIOS 4.1 systems.
- Read the IBM bulletin and match your release to the fix level.
- Apply the update, starting with shared and multi-tenant partitions.
- Review who holds the rights needed to mount external or user supplied filesystem images, and remove what is not needed.
- Re-run the level commands after patching and store the output as evidence.
- Treat unexplained kernel panics during directory reads as a signal to investigate.
Why it matters
This is an CWE-787 (out-of-bounds write) bug, found in the code that reads directories from a filesystem. Filesystem drivers trust on-disk structures, and a crafted image can contain values the code never expected. When the driver writes past the end of a kernel stack buffer, the damage lands in memory the whole system depends on.
IBM says a crash is the likely result and privilege escalation is possible. Because it needs local access and high privileges, it is a stepping stone more than a front door. It matters most on systems shared between teams, where a compromised account with enough rights could turn into full kernel control.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can this be exploited remotely?
The record's vector is local, with high privileges required. The attacker needs a way to have the kernel read a crafted filesystem image on the host.
Do I need to patch if I already patched the IPsec issue?
Both CVEs sit in the same IBM bulletin. Check that the fix level you applied is listed for this CVE as well, and rerun the level command to confirm.
Sources
Last reviewed: 18 October 2026.
