IBM PowerVM Hypervisor EUVD-2026-62743

Requires authenticated service-level access to the IBM Power system's service processor (Flexible Service Processor/FSP) - a privileged management interface separate from normal OS or hypervisor user accounts. The attacker must have write capability to firmware configuration data on the service processor, a right typically scoped to Hardware Management Console (HMC) service accounts, IBM service representatives, or equivalent roles. Exploitation is triggered during system initialization/boot when the host firmware parses the crafted configuration, meaning impact is deferred until the next boot cycle rather than immediate. The CVSS S:C (scope changed) metric confirms the effect extends from the service processor to the managed host system. Limiting factors: service processor access is not exposed to general users, typically requires physical or dedicated OOB network connectivity, and exploitation requires knowledge of the proprietary configuration data format. AV:L reflects that exploitation is constrained to local or management-network-level access rather than arbitrary internet exposure.

The CVSS 3.1 score of 7.3 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H signals a local, low-complexity attack with changed scope that delivers high availability impact and limited integrity impact - plausible for a firmware boot stack crash. However, the most significant real-world limiting factor is the prerequisite of authenticated service-level access to the service processor, which in IBM Power environments is restricted to service accounts, Hardware Management Console (HMC) administrators, or IBM service representatives. This is a more privileged access class than PR:L typically implies, suggesting the assigned CVSS may slightly overstate accessibility. No EPSS data was provided in the input; without KEV listing and no identified POC, the probability of widespread opportunistic exploitation is low. The primary threat scenario is insider threat or a compromised privileged service account targeting critical Power infrastructure. The scope-change (S:C) metric accurately reflects that a service processor compromise propagates to crash the managed host firmware - an important escalation path in multi-LPAR environments. Real-world priority should be elevated for organizations running critical IBM Power workloads (e.g., AIX, IBM i) where firmware stability is essential, but the restricted access prerequisite meaningfully limits exposure for properly segmented environments.

An attacker who has obtained authenticated service-level credentials to the IBM Power system's Flexible Service Processor - via credential theft, insider access, or HMC compromise - writes specially crafted firmware configuration data to the service processor. On the next system power-on or firmware initialization cycle, the host firmware boot stack parses the malicious configuration, triggering a stack-based buffer overflow (CWE-121) that crashes the boot process and may corrupt memory during initialization, leaving the managed system unavailable or in an inconsistent state. No public POC has been identified; exploitation requires precise knowledge of the configuration data format.