CVE-2026-17093 is a stack-based buffer overflow vulnerability (CWE-121) in IBM Power Systems Firmware affecting multiple firmware versions across Power9 and Power HMC platforms. The vulnerability arises during host firmware configuration parsing. An attacker with service-level privileges on the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) can exploit this flaw by providing maliciously crafted configuration data. Successful exploitation compromises the host firmware boot stage and all code loaded thereafter, resulting in a complete compromise of confidentiality, integrity, and availability of the affected system.

Exploitation leads to full compromise of the host firmware boot process and all subsequent components loaded by it. This results in high impact on confidentiality, integrity, and availability of the managed IBM Power Systems. The CVSS v3.1 score is 8.2 (High), reflecting the requirement for local attacker privileges with high access (service-level) but no user interaction, and the potential for complete system compromise.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict service-level access to the BMC/FSP to trusted administrators only to reduce risk of exploitation.