High CVSS 7.3
CVE-2026-18871
Ibm Power System S1122 \(9824-22a\) Firmware
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.
What this means
- Exposure
- Exploitable with local access to the machine, with an ordinary user account and with no action from the victim.
- Impact
- An attacker can alter some data and take the service offline. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- A stack overflow overwrites the return address, which often leads to code execution.
- Likelihood
- Its EPSS score stays low: nothing points to imminent exploitation, which is no reason to leave it unpatched.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.