This vulnerability results from insufficient cryptographic entropy in the Transparent Memory Encryption (TME) hardware used by IBM PowerVM Hypervisor. An attacker who has physical access to the hardware can leverage the weak entropy to derive keys and decrypt encrypted memory, thereby compromising the confidentiality of virtual machine data and other sensitive information in the hypervisor state. The weakness is classified as CWE‑331, a lack of entropy or randomness in a cryptographic operation.

Affected firmware ranges include FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 for IBM PowerVM Hypervisor, impacting Power 10 and Power 11 systems such as the E1180, S1122, S1124, S1114, L1122, L1124, E1150, E1080, S1022, S1024, S1014, L1022, L1024, E1050, and S1012. These models are licensed under multiple marketplace listings with specific firmware update requirements.

The CVSS score of 4.2 indicates low to moderate severity. The EPSS score of less than 1% suggests a very low likelihood of widespread exploitation. Because the attack requires physical presence at the server, the attack vector is limited to compromised data centers or manufacturing sites. The vulnerability is not listed in the CISA KEV catalog, further indicating relatively low exposure at present. Nonetheless, any instance of successful exploitation would allow an attacker to read otherwise protected memory contents.