CVE-2026-17042
Received Received - Intake

Memory Corruption in IBM Power Systems Firmware

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description
IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-20
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-17042
EUVD
EUVD-2026-62696

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
ibm power_systems_firmware From 950.00 (inc) to 950.H2 (inc)
ibm power_systems_firmware From 940.00 (inc) to 940.a1 (inc)
ibm power_systems_firmware From 940.00 (inc) to 940.81 (inc)
ibm power_systems_firmware From op940.00 (inc) to op940.a1 (inc)
ibm power_systems_firmware to op940.81 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17042 is a flaw in IBM Power Systems Firmware where improper parsing of NVRAM during the host firmware boot stage can be exploited. An attacker with root access to a guest partition on an OpenPOWER system can craft a malicious NVRAM image to crash the host firmware and potentially corrupt memory. This requires operator intervention to clear NVRAM via the service processor to restore normal operation.

Detection Guidance

Detection requires checking firmware versions on OpenPOWER systems. Compare installed firmware against affected versions: FW950.00 to FW950.H2, OP940.00 to OP940.a1 (Power9), or OP940.00 to OP940.81 (Power HMC). Use system management tools or service processor interfaces to inspect firmware versions.

Impact Analysis

If exploited, this vulnerability can cause the host firmware to crash, leading to memory corruption and disrupting system availability. It may also compromise system integrity, requiring manual recovery by clearing NVRAM. Only OpenPOWER systems are affected; PowerVM systems are safe.

Compliance Impact

This vulnerability could lead to integrity and availability impacts, potentially violating compliance requirements for data protection and system availability in standards like GDPR or HIPAA. Unplanned downtime or data corruption may result in non-compliance penalties.

Mitigation Strategies

Update firmware immediately to remediation versions: FW950.H3(950_230) or later for Power9, OP940.a2 or newer for Power9 AC922, or OP940.82 or newer for IBM Power HMC. No workarounds exist; updates are mandatory to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17042. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart