IBM Power Firmware EUVD-2026-97868

Exploitation requires the attacker to already possess authenticated service-level access to the Flexible Service Processor (FSP) and the ability to send messages over the service processor mailbox interface - this is a management-plane privilege, not a host-OS or network credential. The specific trigger is a crafted mailbox message that overflows host firmware runtime attribute storage (CWE-121). Limiting factors: PR:H means high-privilege service-plane authentication is mandatory, AV:L means the service processor interface must be reachable locally (no remote network exploitation), and the flaw is bounded to Power Systems firmware versions FW1060.00 through FW1060.81, so patched or other firmware streams are not affected. Effective exploitation is largely gated by how tightly FSP/HMC/service-processor access is segmented and controlled.

The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) is internally consistent with the description: exploitation requires local, high-privilege access to the Flexible Service Processor (FSP) service interface, but the scope change (S:C) correctly reflects that a compromise of the service processor crosses a trust boundary into the host firmware runtime and the entire managed system (C:H/I:H/A:H). The high score is driven almost entirely by that scope change and full triad impact, NOT by ease of access - the PR:H requirement (authenticated service-level FSP access) is a significant barrier, so this is a high-impact-but-high-barrier flaw rather than a mass-exploitable one. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data; exploitation status is therefore 'no public exploit identified at time of analysis.' This is a real priority for organizations where service-processor/HMC access is shared, outsourced, or inadequately segmented (privilege escalation from service plane to host), but it is not an internet-facing mass-exploitation threat. No SSVC decision data was provided, so automatability and exploitation-status cannot be evaluated from that framework.

An attacker who already holds authenticated service-level access to the FSP - for example a rogue or compromised administrator, or an attacker who has pivoted to the management plane - sends a specially crafted mailbox message over the service processor mailbox interface that overflows host firmware runtime attribute storage. This buffer overflow lets them execute arbitrary code in the host firmware runtime, yielding full access to the managed system's memory and hardware. No public exploit code is identified at time of analysis, and the attack requires local service-level privileges rather than remote network access.