CVE-2026-16661: CWE-190 Integer Overflow or Wraparound in IBM PowerVM Hypervisor

The vulnerability identified as CVE-2026-16661 involves an integer overflow or wraparound (CWE-190) in the IBM PowerVM Hypervisor's service processor mailbox interface. Exploitation requires authenticated service-level access to the FSP. Successful exploitation allows arbitrary code execution within the host firmware runtime environment, granting an attacker full control over the managed system. The vulnerability affects several firmware versions of IBM PowerVM Hypervisor, specifically FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The CVSS v3.1 base score is 8.2, indicating a high severity with impacts to confidentiality, integrity, and availability. No known exploits in the wild or vendor patch information is provided in the data.

An attacker with authenticated service-level access to the FSP can execute arbitrary code in the host firmware runtime, resulting in full control over the managed system. This compromises confidentiality, integrity, and availability of the system. The vulnerability is rated high severity with a CVSS score of 8.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor IBM advisories for updates. Restricting service-level access to the FSP to trusted personnel and systems is recommended to reduce risk until a fix is available.