The vulnerability is a buffer overflow in the host firmware configuration parser of IBM Power Systems firmware versions FW1060.00 through FW1060.81. An attacker with authenticated service-level access to the Facility Service Processor (FSP) can write specially crafted configuration data that corrupts memory during the cold boot stage, compromising the host firmware boot stack and the hypervisor subsequently loaded. Successful exploitation can lead to confidentiality, integrity, and availability compromise of the managed system.

IBM PowerVM Hypervisor firmware versions FW1060.00 to FW1060.81 on IBM Power System servers, including the S1022, S1024, S1022s, S1014, L1022, L1024, E1050, and S1012 models. Customers should apply firmware upgrade FW1060.82(1060_199) or newer to remediate the vulnerability.

The CVSS score of 8.2 indicates high severity. The EPSS score is not available, so the exploitation likelihood cannot be quantified from the CVE data, but the vulnerability is not listed in CISA KEV. Exploitation requires authenticated service-level access to the FSP, implying that privileged internal users or compromised management interfaces are the likely attack vectors.