CVE-2026-18821: Power System Out-of-bounds Write
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Power Systems Firmware (partition firmware during network boot)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_184) - Upgrade
Upgrade
IBM Power Systems Firmware (partition firmware during network boot)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_134) - Upgrade
Upgrade
IBM Power Systems Firmware (partition firmware during network boot)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_155) - Upgrade
Upgrade
IBM Power Systems Firmware (partition firmware during network boot)to a version that resolves this vulnerability.Fixed in FW1120.01(1120_190) - Upgrade
Upgrade
IBM Power Systems Firmware (partition firmware during network boot)to a version that resolves this vulnerability.Fixed in FW950.H3(950_230) - Upgrade
Upgrade
IBM Power Systems Firmware (partition firmware during network boot)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_191) - Upgrade
Upgrade
IBM PowerVM Hypervisor Power Systems Firmwareto a version that resolves this vulnerability.Fixed in FW1120.00 - Compensating control
Ensure only partitions actively performing a network boot are treated as affected; other partitions and the managed system are not affected.
Event History
Frequently Asked Questions
Which systems are exposed to exploitation?
Only a partition that is actively performing a network boot is affected. The attacker must be on the same network as that partition; other partitions and the managed system are not affected.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker on the same network can send a malformed packet during the partition's network boot, and no user interaction is required.
What is the practical impact if exploitation succeeds?
The attacker can execute arbitrary code in the partition firmware and compromise everything subsequently loaded by that partition. The impact includes confidentiality, integrity, and availability consequences for the affected partition.