CVE-2026-16832: CWE-121 Stack-based Buffer Overflow in IBM Power Systems Firmware

CVE-2026-16832 is a stack-based buffer overflow vulnerability in IBM Power Systems Firmware affecting multiple firmware versions. The vulnerability resides in the FSP management network protocol and requires the attacker to have authenticated HMC administrator privileges. Exploitation allows arbitrary code execution on the service processor, granting complete control over the managed system. The vulnerability has a CVSS 3.1 base score of 8.4, indicating high severity with network attack vector requiring high privileges but no user interaction. The impact scope is complete compromise of confidentiality, integrity, and availability of the system.

An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, resulting in full control over the managed system. This compromises confidentiality, integrity, and availability of the system, potentially allowing unauthorized data access, system manipulation, and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict HMC administrator access to trusted personnel only and monitor for any unusual activity related to the FSP management network protocol.