A buffer overflow flaw exists in the PowerVM Hypervisor firmware service processor mailbox interface. When an attacker with authenticated service-level access sends a specially crafted mailbox message, the firmware's runtime attribute storage is overwritten, allowing the attacker to execute arbitrary code. The vulnerability is a classic buffer overflow (CWE‑121) and can lead to full control over the managed system’s memory and hardware appliances, resulting in confidentiality, integrity, and availability compromise.

Affected products include IBM PowerVM Hypervisor firmware versions FW1060.00 through FW1060.81 running on IBM Power System models S1022, S1024, S1022s, S1014, L1022, L1024, E1050, and S1012. Users of these systems should inspect their firmware version and model to determine applicability.

The vulnerability carries a CVSS score of 8.2, indicating high severity, while the EPSS score is not available. It is not listed in the CISA KEV catalog. Exploitation requires authenticated privileged access to the service processor, which may limit the attack surface to insider or compromised management accounts, but once achieved, it offers complete system compromise. The high severity score and the ability to run arbitrary code make the risk significant for operators of vulnerable platforms.