Power Systems Firmware EUVD-2026-62696

Exploitation requires root (superuser) access within a guest partition on the targeted OpenPOWER system - this is a non-negotiable prerequisite with no bypass described. The system must be running IBM Power Systems Firmware in an affected version range (FW950.00 through FW950.H2 or OP940.00 through OP940.a1/OP940.81) and must be operating on the OpenPOWER firmware stack specifically; systems using IBM PowerVM are explicitly excluded from scope per the vendor description. The vulnerability is triggered by writing a crafted NVRAM image from within the guest, followed by a host firmware boot cycle - exploitation is therefore asynchronous, with the crash and memory corruption occurring at the next boot rather than immediately upon write. Limiting factors include the requirement for guest root-level privilege, the OpenPOWER-only scope, and the need to reach the NVRAM write interface from within the guest partition.

The CVSS score of 7.3 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H captures a locally-exploitable, scope-changing flaw with high availability and low integrity impact. The Scope:Changed designation is the key risk amplifier: an attacker operating within a guest VM can disrupt the entire physical host, potentially affecting all co-located workloads simultaneously. Real-world risk is sharply tiered by deployment model - shared multi-tenant OpenPOWER environments such as cloud providers, hosting facilities, or enterprise data centers with multiple guest partitions under differing trust levels face materially higher exposure than single-tenant or air-gapped POWER deployments. Note that the IBM-supplied CVSS vector assigns PR:L, but the description requires root access within a guest partition, which this analyst assesses as PR:H; teams relying on the vendor CVSS for risk scoring should be aware of this discrepancy. No CISA KEV listing and no public proof-of-concept code were identified in the available intelligence, leaving exploitation probability unquantified - EPSS data was not provided. The persistence of the denial-of-service condition, requiring manual operator NVRAM recovery, significantly elevates operational impact relative to self-recovering crashes.

An attacker who has obtained root access within a guest partition on a shared OpenPOWER server - for example, via a compromised containerized workload or a rogue cloud tenant - crafts a malformed NVRAM image designed to trigger an out-of-bounds read during host firmware NVRAM parsing. The attacker writes this image to the guest NVRAM, causing the host firmware boot stage to crash with memory corruption on the next boot cycle, rendering all co-hosted guest partitions inaccessible. Recovery requires physical or out-of-band operator intervention to clear NVRAM via the service processor, creating an extended denial-of-service window. No public proof-of-concept code has been identified at time of analysis.