IBM PowerVM Hypervisor firmware versions 1120.00‑1120.01, 1110.00‑1110.31, 1060.00‑1060.81, and 950.00‑950.H3 contain an out‑of‑bounds read flaw that can lead to the disclosure of sensitive configuration or data. The vulnerability is an information‑disclosure weakness (CWE‑125). The CVE description states that a remote attacker could obtain sensitive information if the flaw is triggered, but it does not specify the exact method of exploitation or required privileges, so the likelihood of a remote attack vector is inferred from the wording.

IBM PowerVM Hypervisor firmware on IBM Power Systems, including models E1180, S1122, S1124, S1122s, S1114, L1122, L1124, E1150, S1112, E1080, S1022, S1024, S1022s, S1014, L1022, L1024, E1050, S1012, S922, H922, S914, S924, H924, E950, and E980. Affected firmware ranges are 1120.00‑1120.01, 1110.00‑1110.31, 1060.00‑1060.81, and 950.00‑950.H3.

The flaw presents an information‑disclosure risk with a CVSS score of 4.3. The EPSS score is below 1 %, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited in the wild. The potential to leak sensitive data warrants remediation, even though the severity rating is moderate. Based on the description, it is inferred that the likely attack vector is remote.