IBM Power Firmware EUVD-2026-62682

Exploitation requires service access to the service processor, meaning the attacker must hold high-privileged credentials for the IBM Power service processor interface (CVSS PR:H) on a locally or network-reachable service processor (CVSS AV:L). The attack targets a specific code path triggered by a crafted command, implying the command must be well-formed enough to reach the vulnerable integer arithmetic while still containing the malicious value - however, CVSS AC:L indicates this crafting is not complex once access is held. Limiting factors: the attacker cannot be an anonymous remote party - service processor access requires prior credential compromise or insider status; exploitation does not require user interaction on the host side (UI:N); the vulnerability does not appear to require a non-default configuration, but is constrained to the three specific firmware version lines listed.

The CVSS base score of 6.7 (Medium) reflects a meaningful but access-constrained vulnerability. The vector AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H indicates the attack requires local, high-privileged service-processor access, which significantly limits the realistic attacker pool to insiders, supply-chain actors, or those who have already compromised service processor credentials. The scope change (S:C) elevates concern because exploitation extends from the service processor isolation boundary into the host system. One notable discrepancy: the CVSS assigns A:H (high availability impact to the host), while IBM's description states only 'limited availability impacts' - this tension is unresolved in available data and may reflect worst-case scenario modeling in the CVSS score. No EPSS data was provided, and the absence of a KEV listing indicates no confirmed active exploitation. Given the PR:H prerequisite and niche attack surface (service processor access), real-world exploitation risk is low to moderate for organizations that restrict service processor access. For environments where service processor credentials are shared or weakly managed, the risk is elevated.

An insider or attacker who has obtained service processor credentials - through credential theft, weak default passwords, or privileged access abuse - connects to the IBM Power service processor interface and sends a specially crafted command that triggers an integer overflow in the host firmware's command handler. The overflow bypasses register isolation logic, causing the firmware to return contents of hardware registers that are normally invisible to the service processor, potentially exposing sensitive host system state or configuration data. No public proof-of-concept code has been identified at time of analysis.