IBM Power Firmware EUVD-2026-97871

Exploitation requires authenticated service-level access to the service processor (baseboard/flexible service processor) of an affected IBM Power system running host firmware FW1060.00 through FW1060.81, plus the ability to write host firmware configuration data that is parsed during system initialization. The vulnerable code path is the host firmware configuration parser, and the crash is triggered on the next system boot/initialization rather than instantly. Key limiting factors: the attacker must already possess valid service-processor authentication (PR:L) and local access to the management plane (AV:L) - there is no network-facing or unauthenticated path, and no end-user interaction is involved; this confines realistic exploitation to malicious or compromised infrastructure operators and adversaries who have already reached the hardware management layer.

This is a moderate-severity (CVSS 7.3) flaw whose real-world risk is constrained by its access requirements rather than its impact. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H shows local attack vector (AV:L) requiring existing low-level privileges (PR:L) - the description clarifies this means authenticated service-level access to the service processor, a significant precondition that a remote, unauthenticated adversary does not meet. The elevated score is driven primarily by the changed scope (S:C) and high availability impact (A:H), reflecting that compromise of the service processor crosses a trust boundary to crash the managed host firmware. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. Signals are internally consistent - no conflict between the vector and description - but the EPSS probability is absent and cannot be used to gauge likelihood. Overall this is a 'defense-in-depth / insider-and-lateral-movement' concern for operators of affected IBM Power hardware rather than an urgent internet-facing emergency; prioritize patching where service-processor access is broadly delegated, but it does not warrant drop-everything treatment absent exploitation evidence.

An attacker who already holds authenticated service-level credentials on the service processor (e.g., a malicious or compromised infrastructure operator, or an adversary who has pivoted to the management plane) writes specially crafted host firmware configuration data. During the next system initialization, the malformed data overflows a stack buffer in the firmware configuration parser, crashing the host firmware boot stack with possible memory corruption and denying availability of the managed system. No public exploit code is identified at time of analysis.