CVE-2026-16707: Power System Out-of-bounds Read
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
Other sources
Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Power Systems service processor firmware (FSP)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_184) - Upgrade
Upgrade
IBM Power Systems service processor firmware (FSP)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_134) - Upgrade
Upgrade
IBM Power Systems service processor firmware (FSP)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_155) - Upgrade
Upgrade
IBM Power Systems service processor firmware (FSP)to a version that resolves this vulnerability.Fixed in FW1120.01(1120_190) - Upgrade
Upgrade
IBM Power Systems service processor firmware (FSP)to a version that resolves this vulnerability.Fixed in FW950.H3(950_230) - Upgrade
Upgrade
IBM Power Systems service processor firmware (FSP)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_191)
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
An attacker needs authenticated service-level access to the Flexible Service Processor (FSP). The issue is exploited by sending a specially crafted message through the service processor mailbox interface.
Can exploitation affect components beyond the service processor?
Yes. The attacker can read or modify arbitrary Hostboot memory regions, which can compromise the host firmware boot stack and the hypervisor loaded afterward. This can affect confidentiality, integrity, and availability of the managed system.