CVE-2026-19448

Received Received - Intake

Stack Memory Corruption in IBM AIX and PowerVM VIOS

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: IBM Corporation

Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decapsulation handler. Successful exploitation may corrupt kernel stack state and cause a system crash, resulting in denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-19448

EUVD

EUVD-2026-63752

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aix	7.2
ibm	aix	7.3
ibm	powervm_vios	4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This is a stack memory corruption vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. It occurs in the IPsec ESP decapsulation handler, where improper handling may corrupt kernel stack memory. Successful exploitation could lead to a system crash, causing a denial of service.

Detection Guidance

This vulnerability involves a stack memory corruption in IBM AIX IPsec ESP decapsulation. Detection requires monitoring for system crashes or kernel errors related to IPsec processing. Check AIX error logs for kernel panics or stack corruption messages. Use commands like 'errpt -a' to review error logs and 'netstat -s' to monitor IPsec-related network statistics. Ensure IPsec logging is enabled in the AIX configuration.

Impact Analysis

If exploited, this vulnerability could cause your IBM AIX or PowerVM VIOS system to crash, resulting in service disruption and downtime. It may allow attackers to disrupt operations but does not directly lead to data theft or unauthorized access.

Compliance Impact

This vulnerability could impact compliance by causing system outages, which may violate availability requirements in GDPR or HIPAA. Downtime could lead to unauthorized access risks or failure to meet service level agreements.

Mitigation Strategies

Apply IBM AIX and PowerVM VIOS security patches or updates provided by IBM to address the stack memory corruption vulnerability in the IPsec ESP decapsulation handler. Monitor IBM PSIRT advisories for fixes and disable IPsec ESP decapsulation if not required until patched.

Hi! I’m here to help you understand CVE-2026-19448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70