CVE-2026-17042

HIGH 7.3

Power System Out-of-bounds Read

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

CWE	CWE-125
Vendor	ibm
Product	power systems firmware
Published	Aug 19, 2026
Last Updated	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for ibm power systems firmware

Be the first to know when new high vulnerabilities affecting ibm power systems firmware are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

High

Affected Versions

IBM / Power Systems Firmware

FW950.00 ≤ FW950.H2 OP940.00 ≤ OP940.a1 OP940.00 ≤ OP940.81

References

NVD ↗ CVE.org ↗ EPSS Data ↗

ibm.com: https://www.ibm.com/support/pages/node/7283240