CVE-2026-17042

Power System Out-of-bounds Read

Published Aug 19, 2026 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Description
IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

Remediation

Vendor Solution

Customers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability. Power 9 * IBM Power System S922 (9009-22G) * IBM Power System H922 (9223-22S) * IBM Power System S914 (9009-41G) * IBM Power System S924 (9009-42G) * IBM Power System H924 (9223-42S) * IBM Power System E950 (9040-MR9) * IBM Power System E980 (9080-M9S) Customers with the products below should install OP940.a2 or newer to remediate this vulnerability. Power 9 * IBM Power System AC922 (8335-GTH, 8335-GTX) Customers with the products below should install OP940.82 or newer to remediate this vulnerability. Power Hardware Management Console * IBM Power Hardware Management Console (7063-CR2) The images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Ibm power Hardware Management Console \(7063-cr2\)
Ibm power Hardware Management Console \(7063-cr2\) Firmware
Ibm power System Ac922 \(8335-gth\)
Ibm power System Ac922 \(8335-gth\) Firmware
Ibm power System Ac922 \(8335-gtx\)
Ibm power System Ac922 \(8335-gtx\) Firmware
Ibm power System E950 \(9040-mr9\)
Ibm power System E950 \(9040-mr9\) Firmware
Ibm power System E980 \(9080-m9s\)
Ibm power System E980 \(9080-m9s\) Firmware
Ibm power System H922 \(9223-22s\)
Ibm power System H922 \(9223-22s\) Firmware
Ibm power System H924 \(9223-42s\)
Ibm power System H924 \(9223-42s\) Firmware
Ibm power System S914 \(9009-41g\)
Ibm power System S914 \(9009-41g\) Firmware
Ibm power System S922 \(9009-22g\)
Ibm power System S922 \(9009-22g\) Firmware
Ibm power System S924 \(9009-42g\)
Ibm power System S924 \(9009-42g\) Firmware
CPEs cpe:2.3:h:ibm:power_hardware_management_console_\(7063-cr2\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_ac922_\(8335-gth\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_ac922_\(8335-gtx\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_hardware_management_console_\(7063-cr2\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:*
Vendors & Products Ibm power Hardware Management Console \(7063-cr2\)
Ibm power Hardware Management Console \(7063-cr2\) Firmware
Ibm power System Ac922 \(8335-gth\)
Ibm power System Ac922 \(8335-gth\) Firmware
Ibm power System Ac922 \(8335-gtx\)
Ibm power System Ac922 \(8335-gtx\) Firmware
Ibm power System E950 \(9040-mr9\)
Ibm power System E950 \(9040-mr9\) Firmware
Ibm power System E980 \(9080-m9s\)
Ibm power System E980 \(9080-m9s\) Firmware
Ibm power System H922 \(9223-22s\)
Ibm power System H922 \(9223-22s\) Firmware
Ibm power System H924 \(9223-42s\)
Ibm power System H924 \(9223-42s\) Firmware
Ibm power System S914 \(9009-41g\)
Ibm power System S914 \(9009-41g\) Firmware
Ibm power System S922 \(9009-22g\)
Ibm power System S922 \(9009-22g\) Firmware
Ibm power System S924 \(9009-42g\)
Ibm power System S924 \(9009-42g\) Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Ibm power Systems Firmware
CPEs cpe:2.3:o:ibm:power_firmware:fw950.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_firmware:fw950.h2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_firmware:op940.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_firmware:op940.a1:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_systems_firmware:fw950.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_systems_firmware:fw950.h2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_systems_firmware:op940.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_systems_firmware:op940.a1:*:*:*:*:*:*:*
Vendors & Products Ibm power Firmware
Ibm power Systems Firmware
Type Values Removed Values Added
Description IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.
Title Power System Out-of-bounds Read
First Time appeared Ibm
Ibm power Firmware
Weaknesses CWE-125
CPEs cpe:2.3:o:ibm:power_firmware:fw950.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_firmware:fw950.h2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_firmware:op940.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power_firmware:op940.a1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm power Firmware
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Aug 19, 2026, 7:46 PM
Reserved
Jul 24, 2026, 12:55 PM
Status
Analyzed
Published
Aug 19, 2026, 8:17 PM
Modified
Aug 25, 2026, 1:14 PM