IBM Power Systems Firmware: Stack-based buffer overflow in host boot image validation
Summary
IBM Power Systems Firmware (PowerVM Hypervisor) contains a stack-based buffer overflow in the validation of host firmware boot images. An attacker with service access to the service processor can supply a maliciously crafted code update image and execute arbitrary code on the host system. IBM rates the impact as high for confidentiality, integrity and availability, with a CVSS 3.1 base score of 8.2.
Affected
- PowerVM Hypervisor firmware FW1120.00 to FW1120.01
- PowerVM Hypervisor firmware FW1110.00 to FW1110.31
- PowerVM Hypervisor firmware FW1060.00 to FW1060.81
Fixed in
- FW1110.32 (1110_138 or 1110_160, depending on the system model) or newer
- FW1120.02 (1120_171 or 1120_195, depending on the system model) or newer
- FW1060.82 (1060_189 or 1060_199, depending on the system model) or newer
- Use the IBM bulletin product table to select the correct level for each machine type.
Workaround
- IBM notes: after a concurrent firmware upgrade, the system must be rebooted to mitigate this CVE.
- No other vendor workaround identified.
- Interim measure (not vendor guidance): restrict FSP and HMC access to trusted administrators on a segregated management network.
Exploitation
- No public proof of concept reported in the sources reviewed (third-party aggregator only).
- Not listed in CISA KEV according to a third-party source; not verified against the KEV catalog.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No known exploitation in the wild.
Our recommendation
- Identify Power systems and their current firmware levels at each customer.
- Schedule updates to the fix level listed for each machine type in the IBM bulletin, and reboot after a concurrent upgrade.
- Until patched, limit FSP and HMC access to trusted administrators on a segregated network.
- Check whether CVE-2026-96266, a related IBM Power firmware issue in the same batch, is covered by its own advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (primary) www.ibm.com
- Strix AI: CVE-2026-96266 (related IBM Power issue) www.strix.ai
- TheHackerWire: CVE-2026-96263 www.thehackerwire.com
- Strix AI: CVE-2026-96263 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:36.
Original description (NVD)
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.