CVE-2026-17040

Received Received - Intake

Buffer Overflow in IBM AIX and PowerVM VIOS

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: IBM Corporation

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-17040

EUVD

EUVD-2026-63641

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aix	7.2
ibm	aix	7.3
ibm	powervm_vios	4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 that allows a remote attacker to execute arbitrary code. It occurs due to improper bounds checking in memory operations, enabling an attacker to overwrite adjacent memory and gain control of the system.

Impact Analysis

If exploited, this vulnerability could allow attackers to take full control of affected systems, install malware, steal data, or disrupt operations. Systems running vulnerable versions of IBM AIX or PowerVM VIOS are at risk if exposed to untrusted networks.

Compliance Impact

This vulnerability allows remote attackers to execute arbitrary code due to a buffer overflow, which could lead to unauthorized access, data breaches, or system compromise. Such risks may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by exposing sensitive information or failing to ensure system integrity and confidentiality.

Mitigation Strategies

Apply the latest IBM AIX and PowerVM VIOS security patches immediately. Isolate affected systems from untrusted networks. Monitor for unusual network traffic or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-17040. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70