CVE-2026-16849
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper check for an array index boundary.
Risk Assessment
A remote attack could cause system unavailability, potentially affecting service availability.
Recommendation
Install security updates from IBM for affected systems.
Other vulnerabilities in IBM AIX
See all- CVE-2016-3053High
IBM AIX contains an unspecified vulnerability that allows a locally authenticated user to obtain root level privileges.
- CVE-2026-18835Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-17422Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow.
- CVE-2026-17160Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation.
- CVE-2026-17157Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
- CVE-2026-17152Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
- CVE-2026-17145Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper privilege management.
- CVE-2026-17142Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper authentication.
- CVE-2026-17141Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
- CVE-2026-17136Critical
IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a format string vulnerability.
Original NVD description (English source)
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper check for an array index boundary.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS