IBM Power Systems Firmware FW1060 memory corruption via config parse
CVE-2026-96266 Published on October 12, 2026
IBM Power Systems Firmware Buffer Overflow
IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.
Vulnerability Analysis
CVE-2026-96266 is exploitable with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Stack Overflow Vulnerability?
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CVE-2026-96266 has been classified to as a Stack Overflow vulnerability or weakness.
Products Associated with CVE-2026-96266
Want to know whenever a new CVE is published for IBM Powervm Hypervisor? stack.watch will email you.
Affected Versions
IBM PowerVM Hypervisor:- Version FW1060.00, <= FW1060.81 is affected.