IBM Power Systems FW1060.xx: Service Proc Mailbox Buffer Overflow
CVE-2026-96264 Published on October 12, 2026
IBM Power Systems Firmware Buffer Overflow
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system.
Vulnerability Analysis
CVE-2026-96264 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Stack Overflow Vulnerability?
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVE-2026-96264 has been classified to as a Stack Overflow vulnerability or weakness.
Products Associated with CVE-2026-96264
Want to know whenever a new CVE is published for IBM Powervm Hypervisor? stack.watch will email you.
Affected Versions
IBM PowerVM Hypervisor:- Version FW1060.00, <= FW1060.81 is affected.