Power System Out-of-bounds Read

published 2026-08-19 2 mo ago modified 2026-08-25 2 mo ago also EUVD-2026-62696

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits: 0; none known

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

Patch / fix

fixed in 10 links 1

ibm power_system_s922_(9009-22g)_firmware fw950.h3
ibm power_system_h922_(9223-22s)_firmware fw950.h3
ibm power_system_s914_(9009-41g)_firmware fw950.h3
ibm power_system_s924_(9009-42g)_firmware fw950.h3
ibm power_system_h924_(9223-42s)_firmware fw950.h3
ibm power_system_e950_(9040-mr9)_firmware fw950.h3
ibm power_system_e980_(9080-m9s)_firmware fw950.h3
ibm power_system_ac922_(8335-gth)_firmware op940.a2
ibm power_system_ac922_(8335-gtx)_firmware op940.a2
ibm power_hardware_management_console_(7063-cr2)_firmware op940.82

ibm.com/support/pages/node/7283240 advisory

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-19)

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
NVD	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Affected products

IBM Power Systems Firmware

Classification

Weakness

CWE-125 Out-of-bounds Read

References

ibm.com /support/pages/node/7283240
vendor-advisory, patch

Sources

CVE List CVE-2026-17042
NVD CVE-2026-17042

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary