CVE-2026-96265: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer in IBM PowerVM Hypervisor

CVE-2026-96265 is a CWE-119 type vulnerability affecting IBM Power Systems Firmware FW1060.00 through FW1060.81. It arises from improper restriction of operations within the bounds of a memory buffer in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this flaw by sending specially crafted mailbox messages to read or modify arbitrary Hostboot memory regions. This leads to compromise of the host firmware boot stack and the hypervisor subsequently loaded, resulting in a complete compromise of the managed system's confidentiality, integrity, and availability.

Successful exploitation allows an attacker with authenticated service-level access to read or modify arbitrary memory in the Hostboot firmware, compromising the boot stack and the hypervisor. This results in full confidentiality, integrity, and availability impact on the managed system, potentially allowing persistent control or disruption of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict service-level access to the FSP to trusted personnel only and monitor for unauthorized access attempts.