IBM disclosed a critical (CVSS 9.4) integer underflow in the IPv4 IP-options parser affecting IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1, allowing a remote, unauthenticated attacker to trigger an out-of-bounds read with high integrity and availability impact and limited exposure of memory contents.
What Is It
CVE-2026-16839 is an integer underflow in the IPv4 IP-options parser used by IBM AIX and IBM PowerVM VIOS. The condition is classified as CWE-125 (out-of-bounds read). The scored impact is not primarily information disclosure: the vector rates confidentiality impact as low while rating both integrity and availability as high, consistent with a malformed-packet read that corrupts kernel state or crashes the network stack rather than one that leaks data at scale.
The CVSS 3.1 base score is 9.4 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, network-reachable, low attack complexity, no privileges, and no user interaction required. Exploitability scores 3.9 (the maximum), and impact scores 5.5, reflecting high integrity and availability impact alongside low confidentiality impact.
Why It Matters
The parsing defect sits in IPv4 IP-options handling, which means the vulnerable code path is exercised by network traffic reaching an affected host; IP options are attacker-controlled header content, not an exotic feature the target has to opt into. Combined with AV:N/AC:L/PR:N/UI:N, an attacker needs no credentials, no user interaction, and no unusual conditions to reach the flaw.
The high integrity and availability impacts are what push this into critical territory. Treat it as a remote system-integrity and denial-of-service problem first, and an information-disclosure problem only secondarily.
VIOS in particular underpins virtualized IBM Power environments, so an affected host is often shared infrastructure rather than an isolated endpoint. A single unpatched VIOS partition sits in the I/O path for the LPARs it serves, which raises the blast radius of an availability failure well above what the per-host score suggests.
There is no CISA KEV entry supplied for this CVE, and no evidence of active exploitation is present in the source material.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| IBM | AIX | 7.2, 7.3 |
| IBM | PowerVM VIOS | 4.1 |
Listed CPEs cover cpe:2.3:a:ibm:aix:7.2, 7.2.0, 7.3, 7.3.0, and cpe:2.3:a:ibm:powervm_vios:4.1 and 4.1.0.
Patch Status
The CVE was published 2026-08-19 with NVD status "Received," meaning NVD analysis is not yet complete and the CVSS data shown is IBM's own (source: [email protected]). Scores and affected-version data may be revised once NVD finishes its own analysis.
IBM has published a support advisory at node 7283858; consult it for fix packs and iFix availability for your specific AIX and VIOS levels. No required-action deadline is specified in the supplied data.