IBM Power Systems Firmware up to 1060.81 Host Firmware Configuration Parsing memory corruption

Summaryinfo

A vulnerability marked as very critical has been reported in IBM Power Systems Firmware up to 1060.81. This issue affects some unknown processing of the component Host Firmware Configuration Parsing. Performing a manipulation results in memory corruption. This vulnerability is reported as CVE-2026-96266. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as very critical has been found in IBM Power Systems Firmware up to 1060.81. This affects an unknown code of the component Host Firmware Configuration Parsing. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.

This vulnerability is uniquely identified as CVE-2026-96266. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/12/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Firmware Software

Vendor

• IBM

Name

• Power Systems Firmware

Version

• 1060.0
• 1060.1
• 1060.2
• 1060.3
• 1060.4
• 1060.5
• 1060.6
• 1060.7
• 1060.8
• 1060.9
• 1060.10
• 1060.11
• 1060.12
• 1060.13
• 1060.14
• 1060.15
• 1060.16
• 1060.17
• 1060.18
• 1060.19
• 1060.20
• 1060.21
• 1060.22
• 1060.23
• 1060.24
• 1060.25
• 1060.26
• 1060.27
• 1060.28
• 1060.29
• 1060.30
• 1060.31
• 1060.32
• 1060.33
• 1060.34
• 1060.35
• 1060.36
• 1060.37
• 1060.38
• 1060.39
• 1060.40
• 1060.41
• 1060.42
• 1060.43
• 1060.44
• 1060.45
• 1060.46
• 1060.47
• 1060.48
• 1060.49
• 1060.50
• 1060.51
• 1060.52
• 1060.53
• 1060.54
• 1060.55
• 1060.56
• 1060.57
• 1060.58
• 1060.59
• 1060.60
• 1060.61
• 1060.62
• 1060.63
• 1060.64
• 1060.65
• 1060.66
• 1060.67
• 1060.68
• 1060.69
• 1060.70
• 1060.71
• 1060.72
• 1060.73
• 1060.74
• 1060.75
• 1060.76
• 1060.77
• 1060.78
• 1060.79
• 1060.80
• 1060.81

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion