CVE-2026-19448

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7283858	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:vios::::::::
	cpe:2.3:a:ibm:vios::::::::
	cpe:2.3:a:ibm:vios::::::::

Configuration 2 (hide)

OR	cpe:2.3:o:ibm:aix::::::::
	cpe:2.3:o:ibm:aix::::::::
	cpe:2.3:o:ibm:aix::::::::
	cpe:2.3:o:ibm:aix::::::::

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) IBM AIX 7.2, y 7.3 e IBM PowerVM VIOS 4.1. Existe una vulnerabilidad de corrupción de memoria en la pila en el gestor de desencapsulación ESP de IPsec de AIX. Una explotación exitosa puede corromper el estado de la pila del kernel y causar una caída del sistema, lo que resulta en una denegación de servicio.

Information

Published : 2026-08-20 22:17

Updated : 2026-10-26 10:10

NVD link : CVE-2026-19448

Mitre link : CVE-2026-19448

CVE.ORG link : CVE-2026-19448

JSON object : View

Products Affected

ibm

aix
vios

CWE

CWE-908

Use of Uninitialized Resource

{"id": "CVE-2026-19448", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19448", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T13:52:25.870033Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "AIX", "versions": [{"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}]}, {"cpes": ["cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "PowerVM VIOS", "versions": [{"status": "affected", "version": "4.1"}]}]}], "published": "2026-08-20T22:17:18.440", "references": [{"url": "https://www.ibm.com/support/pages/node/7283858", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-908"}]}], "descriptions": [{"lang": "en", "value": "IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service."}, {"lang": "es", "value": "IBM AIX 7.2, y 7.3 e IBM PowerVM VIOS 4.1. Existe una vulnerabilidad de corrupci\u00f3n de memoria en la pila en el gestor de desencapsulaci\u00f3n ESP de IPsec de AIX. Una explotaci\u00f3n exitosa puede corromper el estado de la pila del kernel y causar una ca\u00edda del sistema, lo que resulta en una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-26T10:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A14B743-DDD2-467F-90E7-3431CE35F835", "versionEndExcluding": "4.1.0.50", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37B446F0-EE99-42EA-99EE-80E517FDCB78", "versionEndExcluding": "4.1.1.30", "versionStartIncluding": "4.1.1.0"}, {"criteria": "cpe:2.3:a:ibm:vios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6245F535-1896-4CC5-8EC9-89C8EF455B8C", "versionEndExcluding": "4.1.2.20", "versionStartIncluding": "4.1.2.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB84A37D-4C98-44FC-8B9B-E14DA7C88ED5", "versionEndIncluding": "7.2.5.212", "versionStartIncluding": "7.2.5"}, {"criteria": "cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA55F75D-C50C-46D2-93CC-EABB8F49B03F", "versionEndIncluding": "7.3.2.5", "versionStartIncluding": "7.3.2"}, {"criteria": "cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4115FCC-1026-417E-8D30-237B2C90367E", "versionEndIncluding": "7.3.3.2", "versionStartIncluding": "7.3.3"}, {"criteria": "cpe:2.3:o:ibm:aix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "340ADD53-8363-4CDA-AEEB-8DC7CB0088D5", "versionEndIncluding": "7.3.4.1", "versionStartIncluding": "7.3.4"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}