Skip to main content

Power Systems Firmware EUVDEUVD-2026-62696

| CVE-2026-17042 HIGH
Out-of-bounds Read (CWE-125)
2026-08-19 ibm GHSA-rcv3-hw8m-43fg
Information Disclosure Buffer Overflow IBM Power Systems Firmware
7.3
CVSS 3.1 · NVD
Share

Severity by source

Vendor (ibm) PRIMARY
HIGH
qualitative
NVD
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
vuln.today AI
6.7 MEDIUM

Exploitation requires root access in a guest partition, warranting PR:H over the vendor-assigned PR:L; scope change to host firmware confirmed; no confidentiality impact described.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 19:55 vuln.today
CVE Published
Aug 19, 2026 - 19:11 cve.org
HIGH 7.3

DescriptionNVD

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention - clearing NVRAM via the service processor - to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

AnalysisAI

Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain root access in guest partition
Delivery
Craft malicious NVRAM image
Exploit
Write image to guest NVRAM
Install
Await or trigger host firmware boot cycle
C2
NVRAM parsed with out-of-bounds read
Execute
Host firmware crash with memory corruption
Impact
All guest workloads unavailable pending manual NVRAM recovery
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires root (superuser) access within a guest partition on the targeted OpenPOWER system - this is a non-negotiable prerequisite with no bypass described. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS score of 7.3 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H captures a locally-exploitable, scope-changing flaw with high availability and low integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained root access within a guest partition on a shared OpenPOWER server - for example, via a compromised containerized workload or a rogue cloud tenant - crafts a malformed NVRAM image designed to trigger an out-of-bounds read during host firmware NVRAM parsing. The attacker writes this image to the guest NVRAM, causing the host firmware boot stage to crash with memory corruption on the next boot cycle, rendering all co-hosted guest partitions inaccessible. …
Remediation Apply the vendor-supplied firmware patch per IBM Security Advisory at https://www.ibm.com/support/pages/node/7283240, which covers fixed versions for the affected FW950 and OP940 branches - exact patched version numbers should be confirmed directly from the advisory, as they were not enumerated in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all IBM Power Systems running OpenPOWER with guest partition isolation and assess which systems host multi-tenant workloads or untrusted guest partitions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Power Systems Firmware

View all
CVE-2026-16687 CRITICAL
9.6 Aug 19

Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
CVE-2026-16835 CRITICAL
9.6 Aug 19

Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
CVE-2026-16832 HIGH
8.4 Aug 19

Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
CVE-2026-18848 HIGH
8.3 Aug 19

Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
CVE-2026-16933 HIGH
8.2 Aug 19

Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
CVE-2026-17494 HIGH
8.2 Aug 19

Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
CVE-2026-16930 HIGH
8.2 Aug 19

Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
CVE-2026-17429 HIGH
8.1 Aug 19

Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor

CVE-2026-17063 HIGH
7.9 Aug 19

IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
CVE-2026-16828 HIGH
7.6 Aug 19

Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
CVE-2026-16938 MEDIUM
6.9 Aug 19

IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-62696 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy