IBM PowerVM Hypervisor firmware versions from FW1110.00 to FW1110.20, FW1060.00 to FW1060.71, and FW950.00 to FW950.H1 contain a buffer overflow that can be triggered by a carefully crafted hypervisor call originating from a guest operating system. The flaw stems from an improper bounds check performed during a buffer copy, resulting in a crash of the hypervisor or corruption of operating system memory integrity. If an attacker succeeds in poisoning guest memory, the damaged hypervisor might allow execution of arbitrary code within the hypervisor environment or enable a denial‑of‑service to the entire host.

Affected systems are IBM PowerVM Hypervisor firmware running on Power 9, Power 10, and Power 11 Power Systems. Firmware releases from FW1110.00 to FW1110.20 are vulnerable on Power 11 models such as the E1180, S1122, S1124, S1114, L1122, L1124, and E1150. Firmware releases from FW1060.00 to FW1060.71 affect Power 10 models such as the E1080, S1022, S1024, S1014, L1022, L1024, E1050, and S1012. Firmware releases from FW950.00 to FW950.H1 impact Power 9 models such as the L922, S922, H922, S914, S924, H924, E950, and E980. The precise hardware model list is provided in the IBM advisory.

The CVSS score of 8.4 indicates high severity, while the EPSS score of less than 1% suggests a relatively low probability of current exploitation in the general population. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to control or influence a guest operating system to issue a malicious hypervisor call, indicating that the likely attack vector is internal or local to the virtual machine. When exploited, the hypervisor may crash or allow memory corruption that could lead to elevated privileges or denial of service for the host system.