CVE-2026-16828: CWE-125 Out-of-bounds Read in IBM Power Systems Firmware

This vulnerability involves an out-of-bounds read in the ASMI web interface of IBM Power Systems Firmware. An unauthenticated attacker with access to the management network can trigger a crash of the ASMI web server, which may cause memory corruption and error log generation. Although the interface restarts automatically, repeated exploitation can cause prolonged denial of access to the ASMI management interface, affecting the integrity and availability of the management functions. Hosted partitions remain unaffected.

The vulnerability allows an unauthenticated attacker on the management network to crash the ASMI web server, potentially causing memory corruption. This results in an integrity and availability impact due to possible sustained loss of access to the ASMI management interface. Hosted partitions are not impacted, limiting the scope to management interface availability and integrity.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to the management network to trusted administrators only to reduce exposure.