The vulnerability is an out‑of‑bounds write (CWE-787) in the IBM PowerVM Hypervisor firmware that is triggered during a network boot. An attacker who is able to send a specially crafted packet to a partition that is currently performing a network boot can cause the firmware to execute arbitrary code. Once the firmware is compromised, all system images and applications loaded by that partition are affected, enabling the attacker to read, modify, or disrupt the partition’s data. The flaw is therefore a high‑impact Remote Code Execution that affects confidentiality, integrity, and availability of the targeted partition, while other partitions and the host remain isolated.

The flaw applies to a range of firmware releases for multiple IBM Power System models. Firmware versions FW1060.00 through FW1060.80, FW1110.00 through FW1110.30, FW1120.00, and FW950.00 through FW950.H2 are vulnerable. Systems affected include Power 11 machines such as the Power System E1180, S1122, S1124, S1114, L1122, L1124, E1150, S1112, and S1122s; Power 10 machines such as the E1080, S1022, S1024, S1014, L1022, L1024, E1050, and S1012; and Power 9 machines such as the S922, H922, S914, S924, H924, E950, and E980. All affected installations should be updated to the corresponding newer firmware releases (e.g., FW1120.01(1120_190), FW1110.31(1110_155), FW1060.81(1060_184), or FW950.H3(950_230)).

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score is not published, but the lack of KEV listing does not diminish the need for remediation. An unauthenticated attacker with network visibility to a partition executing a network boot can trigger the flaw without any authentication requirement, making the potential for exploitation high in environments where network boot is enabled. Prompt replacement of the firmware with a fixed version is the only guaranteed defense; disabling network boot for nonessential partitions also reduces exposure.