EUVD-2026-85890
GHSA-36hq-8wph-q8rm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain root on a guest partition
-
ExploitCraft malformed request to partition firmware runtime
-
ExecutionTrigger integer underflow (CWE-191)
-
ImpactCrash firmware runtime with possible memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Requires the attacker to already hold root-level access inside a guest logical partition (LPAR) on an affected IBM Power server, and local access to send a crafted request to the partition firmware runtime interface (AV:L/PR:H). Affected firmware: FW1120.00-FW1120.01, FW1110.00-FW1110.31, FW1060.00-FW1060.81, FW950.00-FW950.H3. Limiting factors: no remote vector, no unauthenticated path, and no user interaction bypass - the prerequisite guest-root compromise is a significant barrier, confining this to malicious/compromised tenants or insiders on shared Power hardware. Realistic impact is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. |
| Impact | This is a genuine but bounded, low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H, base 5.1 MEDIUM) makes the constraints clear: exploitation is LOCAL and requires HIGH privileges - specifically root inside a logical partition (LPAR). This is not a remotely reachable flaw and cannot be triggered by an unprivileged user. The security value lies in the trust-boundary crossing: a fully-compromised guest partition can reach down into the shared PowerVM partition firmware runtime. Impact is availability-heavy (A:H, a crash of the firmware runtime) with only partial integrity impact (I:L, 'possible memory corruption') and no confidentiality impact (C:N). Scope is Unchanged (S:U), so IBM did not assess a hypervisor-wide/host escape - the effect is described as a crash of the partition firmware runtime rather than confirmed cross-partition code execution. No EPSS score, no CISA KEV listing, and no POC are present in the input, so there is no signal of active or automatable exploitation; a low real-world exploitation likelihood is consistent with the local-plus-root prerequisite. The 'possible memory corruption' wording is the only ambiguity - it leaves open a theoretical path beyond DoS, but IBM did not rate confidentiality or full integrity impact, so the corruption should be treated as a crash/reliability issue, not a proven code-execution primitive, absent further vendor detail. |
| Exploit ScenarioDerived | An attacker who has already gained root on a guest LPAR (e.g., via a separate OS compromise or a malicious tenant on a shared IBM Power frame) crafts a malformed request to the partition firmware runtime interface. The integer underflow (CWE-191) is triggered, crashing the firmware runtime with possible memory corruption and disrupting that partition. No public exploit identified at time of analysis; exploitation requires pre-existing root access and local access to the partition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Local root access inside a guest logical partition (LPAR) on IBM PowerVM systems running affected partition firmware allows an attacker to send a crafted request to the partition firmware runtime and crash it, with possible memory corruption. Rated CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), the flaw affects firmware lines FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81 and FW950.00 through FW950.H3; no public exploit has been identified at time of analysis, and the realistic outcome is denial of service to the partition firmware runtime rather than confirmed cross-partition code execution. The guest-root prerequisite makes this a bounded, low-priority risk relevant mainly to multi-tenant or compromised LPARs on shared Power hardware.
RemediationAI
Patch status is not fully specified in the available data: no vendor-released fixed firmware version number was provided, so consult IBM's advisory (https://www.ibm.com/support/pages/node/7289130) for the corrected PowerVM hypervisor / partition firmware level for each affected line and schedule the firmware update in a maintenance window, noting that applying hypervisor firmware typically requires a partition and/or managed-system restart with associated downtime. Because exploitation requires root inside a guest LPAR, the highest-value compensating controls are access-oriented: remove root privileges from untrusted tenants and workloads inside guest LPARs, and avoid co-locating mutually untrusted tenants on the same Power server where the business case allows - the trade-off is reduced hardware consolidation and higher infrastructure cost, but it eliminates the prerequisite foothold. Restrict hypervisor and partition management access (HMC, VIOS, and FSP paths) to dedicated administrative networks, since an attacker who cannot reach those planes cannot escalate from a guest-root crash into platform-level actions; monitoring for partition firmware runtime crashes and unexpected LPAR resets gives detection coverage in the interim and costs little, though it is detective rather than preventive. Blocking or filtering the firmware request interface entirely is not practical on PowerVM because guest partitions depend on the partition firmware runtime for normal platform services, so disabling it would break guest operation - which is why the firmware update remains the definitive fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability sits in the PowerVM partition firmware runtime - the hypervisor-side code that services requests issued from guest LPAR firmware (the RTAS-style call interface that virtualized partitions use to reach platform services). Its root cause is classified as CWE-191 (Integer Underflow / wraparound), corroborated by the Buffer Overflow and Integer Overflow tags on the report: a crafted request is expected to drive a length or size calculation below its valid minimum, producing a wrapped value that is then used for memory access, which the firmware runtime does not validate, resulting in a crash and possible memory corruption. The assessed vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H confirms the attack is strictly local to the partition and requires high privileges (root) inside the guest, with no user interaction and no scope change - meaning the impact is contained within the firmware runtime rather than crossing partition boundaries, and the primary consequence is high availability loss (runtime crash) with only low integrity impact and no confidentiality impact. No CPE identifiers were supplied with the report, so affected scope is defined by the IBM firmware level ranges rather than machine-readable CPE strings, and the only authoritative reference is IBM's advisory node (https://www.ibm.com/support/pages/node/7289130).
Know when Powervm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Local vector and root-in-partition prerequisite give AV:L/PR:H; primary impact is a firmware crash (A:H) with only possible corruption (I:L) and no data disclosure (C:N), scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime. An attacker with root access to a partition can send a specially crafted request to the partition firmware runtime, causing it to crash with possible memory corruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service acce
Root-level attackers inside an IBM PowerVM logical partition can corrupt the partition firmware runtime boot configurati
Denial of service in IBM PowerVM Hypervisor firmware affects logical partitions running affected FW1120, FW1110, FW1060,
Improper handling of sensitive data in the IBM PowerVM Hypervisor partition resource dump interface allows an authentica
Exploit-DB