CVE-2026-18871
Received Received - Intake

IBM PowerVM Hypervisor Firmware Configuration Parsing Flaw

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-20
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-18871
EUVD
EUVD-2026-62743

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ibm powervm_hypervisor From fw1110.00 (inc) to fw1110.30 (inc)
ibm powervm_hypervisor From fw1060.00 (inc) to fw1060.80 (inc)
ibm powervm_hypervisor fw1120.00

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects IBM PowerVM Hypervisor firmware versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. It involves a flaw in host firmware configuration parsing where an attacker with authenticated service-level access can write specially crafted configuration data. This triggers a stack-based buffer overflow, causing the host firmware boot stack to crash during system initialization with possible memory corruption.

Detection Guidance

Detection requires checking the firmware version of IBM Power Systems. Use IBM's firmware update tools or service processor commands to verify if your system is running affected versions (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80). Compare against IBM's remediation guide.

Impact Analysis

The impact includes integrity and availability issues for the managed system. The host firmware crash during initialization could lead to system instability or failure. Since the attacker needs authenticated service-level access, the risk is limited to those with such privileges.

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA due to its potential to cause system crashes and memory corruption during initialization, leading to integrity and availability issues. Such disruptions may violate requirements for data integrity, availability, and security controls in these regulations.

Mitigation Strategies

Apply the firmware updates provided by IBM for your specific Power System model. No workarounds exist, so updating to the patched firmware versions is critical to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18871. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart