IBM disclosed a critical heap buffer overflow in AIX 7.2/7.3 and PowerVM VIOS 4.1 that, per IBM's own advisory language, could allow a remote attacker to execute arbitrary code. The CVSS vector indicates no privileges or user interaction are required, which points to a pre-authentication attack path, though IBM has not published exploitation details to confirm that reading.
What Is It
CVE-2026-16845 is an out-of-bounds write (CWE-787), specifically a heap buffer overflow; affecting IBM AIX and IBM PowerVM VIOS. Per IBM's PSIRT, the flaw "could allow a remote attacker to execute arbitrary code."
IBM assigned a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That decomposes to network-reachable, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. The exploitability subscore is the maximum 3.9.
Why It Matters
If the vector holds up in practice, remote code execution without prior authentication on AIX and VIOS is about as bad as it gets for the systems that typically run them. VIOS in particular is the I/O virtualization layer underneath IBM Power partitions, so compromise there sits below the guest operating systems it serves.
There is no CISA KEV entry for this CVE, and no evidence of active exploitation in the supplied data. The record's NVD status is "Received," meaning it has not yet completed NVD analysis; CPE and reference enrichment may still change, and the scoring itself is IBM's rather than NVD-validated.
What's Vulnerable
Per IBM's affected-product data:
- IBM AIX: 7.2 (incl. 7.2.0) and 7.3 (incl. 7.3.0)
- IBM PowerVM VIOS: 4.1 (incl. 4.1.0)
No other products or versions are listed in the supplied record.
Patch Status
IBM published a support bulletin for this issue (node 7283858). The supplied data does not specify fix levels, iFix names, or workarounds, and no CISA-mandated remediation deadline exists because the CVE is not on the KEV catalog. Administrators should consult the IBM advisory directly for the applicable APAR/iFix and apply it; a vendor-scored 9.8 with a network-reachable, no-privileges vector warrants emergency-change handling rather than a routine patch cycle, even absent public exploitation.
Sources
- NVD, CVE-2026-16845: https://nvd.nist.gov/vuln/detail/CVE-2026-16845
- IBM Support (PSIRT advisory): https://www.ibm.com/support/pages/node/7283858