IBM Power Systems Firmware: Stack-based buffer overflow in host firmware boot stage
Summary
IBM Power 10 systems running Power Systems Firmware (PowerVM Hypervisor) FW1060.00 through FW1060.81 are affected by a stack-based buffer overflow (CWE-121) in the parsing of host firmware configuration data. An attacker with authenticated service-level access to the FSP can write crafted configuration data that corrupts memory during system IPL, which can compromise the host firmware boot stack and the hypervisor loaded afterwards. IBM rates the impact as high for confidentiality, integrity and availability of the managed system.
Affected
- IBM Power Systems Firmware / PowerVM Hypervisor FW1060.00 through FW1060.81
- Power 10 models per IBM: S1022 (9105-22A), S1024 (9105-42A), S1022s (9105-22B), S1014 (9105-41B), L1022 (9786-22H), L1024 (9786-42H), E1050 (9043-MRX), S1012 (9028-21B)
Fixed in
- Install FW1060.82 (1060_199) or newer, as listed in the IBM Security Bulletin.
Workaround
Unknown. IBM lists no workarounds or mitigations.
Exploitation
- CISA KEV: not listed.
- CISA SSVC (in the CVE record): exploitation none, automatable no, technical impact total.
- No public proof of concept or in-the-wild exploitation found in the sources reviewed.
- EPSS score not available.
Our recommendation
- Check the inventory for Power 10 systems and their firmware level.
- Plan the update to FW1060.82 (1060_199) or newer in the next maintenance window.
- Restrict FSP and HMC access to a dedicated administration network.
- Limit and review accounts with service-level access to the FSP.
- Monitor FSP and HMC access logs for unusual configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (vendor advisory) www.ibm.com
- OpenCVE (KEV and SSVC data) app.opencve.io
- Vulners / Rapid7 record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:35.
Original description (NVD)
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.