A buffer overflow exists in the service processor mailbox interface of IBM Power Systems firmware versions FW1060.00 through FW1060.81. An attacker who owns authenticated service‑level access to the Flexible Service Processor can send a specially crafted mailbox message, causing host firmware runtime attribute storage to overflow. This permits arbitrary code execution within the host firmware runtime, giving the attacker complete control over the system’s memory and hardware interfaces. The resulting impact includes loss of confidentiality, integrity and availability for the managed system.

Products affected are the IBM PowerVM Hypervisor firmware intended for IBM Power 10 and earlier systems, specifically the hardware models: Power System S1022 (9105‑22A), S1024 (9105‑42A), S1022s (9105‑22B), S1014 (9105‑41B), L1022 (9786‑22H), L1024 (9786‑42H), E1050 (9043‑MRX) and S1012 (9028‑21B). All installations running firmware versions FW1060.00 through FW1060.81 are vulnerable.

The CVSS score of 8.2 indicates a high severity vulnerability. Because no EPSS score is listed, the likelihood of exploitation is uncertain but potentially low to moderate; however, the vulnerability is only exploitable by an attacker who has authenticated service‑level access to the FSP. The vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an authenticated attacker sending a malicious mailbox message via the service processor interface, which may require physical or privileged network access. Once exploited, the attacker can execute unchecked code, leading to full compromise of the host system.