Vulnerability · Published Aug 19, 2026 · Assigned by ibm

CVE-2026-17042Power System Out-of-bounds Read

High 7.3

In plain English

A high-severity out-of-bounds read in Power Systems Firmware from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.1%top 96.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

Affected products (as reported)

Vendor	Product	Versions
IBM	Power Systems Firmware	FW950.00 – through FW950.H2OP940.00 – through OP940.a1OP940.00 – through OP940.81

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

References

https://www.ibm.com/support/pages/node/7283240 vendor-advisory, patch