IBM Power Systems firmware from versions FW1060.00 through FW1060.81 is vulnerable to a buffer overflow in host firmware configuration parsing. An attacker who has authenticated, service‑level access to the service processor can inject specially crafted configuration data, causing the host firmware boot stack to crash and potentially corrupt memory during system initialisation. This results in integrity and availability impacts to the managed system.

Vendors and products affected include IBM PowerVM Hypervisor firmware running on IBM Power System models such as S1022 (9105‑22A), S1024 (9105‑42A), S1022s (9105‑22B), S1014 (9105‑41B), L1022 (9786‑22H), L1024 (9786‑42H), E1050 (9043‑MRX) and S1012 (9028‑21B). The vulnerability applies to firmware releases FW1060.00 to FW1060.81 inclusive on Power 10 platforms.

The CVSS score of 7.3 indicates high severity, and the EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalogue. Exploitation requires authenticated, service‑level credentials on the service processor, suggesting the threat vector is internal or a compromise of the service‑processor console. Once exploited, the attacker could force a reboot, crash the system, or corrupt the boot stack, leading to loss of system availability and potential integrity compromise during boot.