CVE-2026-18871 is a stack-based buffer overflow vulnerability (CWE-121) in the IBM PowerVM Hypervisor firmware. The flaw occurs in the parsing of host firmware configuration data. An attacker with authenticated service-level access to the service processor can exploit this by writing specially crafted configuration data, causing a crash of the host firmware boot stack and possible memory corruption during system initialization. This vulnerability impacts system integrity and availability but does not affect confidentiality. The CVSS 3.1 base score is 7.3, reflecting a high severity with local attack vector, low attack complexity, low privileges required, no user interaction, and scope changed. No patch or official remediation information is currently provided by IBM, and no known exploits are reported in the wild.

Successful exploitation can cause the host firmware boot stack to crash and potentially corrupt memory during system initialization, leading to loss of system integrity and availability. Confidentiality is not impacted. The vulnerability requires authenticated service-level access to the service processor and is exploitable locally.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated service-level access to trusted personnel only and monitor for unusual configuration changes. No official fix or workaround has been published at this time.