CVE-2026-18871: Power System Buffer Overflow
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.
Other sources
Power Systems Firmware is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Power Systems service processor host firmware (Power System E1050/E1080/E1150/E1180/L1022/L1024/L1122/L1124/S1012/S1014/S1022/S1022s/S1024/S1112/S1114/S1122/S1122s/S1124)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_184) - Upgrade
Upgrade
IBM Power Systems service processor host firmware (subset)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_134) - Upgrade
Upgrade
IBM Power Systems service processor host firmware (subset)to a version that resolves this vulnerability.Fixed in FW1110.31(1110_155) - Upgrade
Upgrade
IBM Power Systems service processor host firmware (subset)to a version that resolves this vulnerability.Fixed in FW1120.01(1120_190) - Upgrade
Upgrade
IBM Power Systems service processor host firmware (subset)to a version that resolves this vulnerability.Fixed in FW1060.81(1060_191)
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs authenticated service-level access to the service processor. The issue affects managed systems running the listed IBM PowerVM Hypervisor firmware levels.
What is the impact of successful exploitation?
Specially crafted configuration data can crash the host firmware boot stack during system initialisation and may cause memory corruption. The stated impacts are loss of availability and integrity to the managed system.
How can an administrator determine whether a system is affected?
Check the installed firmware level. Affected levels are FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.