CVE-2026-17042 is a high severity (CVSS 7.3) out-of-bounds read in the host firmware NVRAM parsing of IBM Power Systems firmware. A guest partition root user on an OpenPOWER system can crash the host boot stage. IBM lists fixed firmware FW950.H3, OP940.a2 and OP940.82.
What's affected
Per IBM's bulletin, the affected firmware is FW950.00 through FW950.H2, OP940.00 through OP940.a1 on Power9, and OP940.00 through OP940.81 on Power HMC. IBM says only OpenPOWER systems are affected, and systems running PowerVM are not.
Fixed levels named in the bulletin:
- FW950.H3 (950_230) or newer for Power S922, H922, S914, S924, H924, E950 and E980
- OP940.a2 or newer for Power System AC922 (8335-GTH and 8335-GTX)
- OP940.82 or newer for the Power Hardware Management Console 7063-CR2
Images are on IBM Fix Central. The NVD record's version ranges match the bulletin.
How to check if you're exposed
Read the firmware level of each Power system from its service processor or from the HMC, and compare it with the ranges above. First decide whether a system runs OpenPOWER or PowerVM. IBM says PowerVM systems are not affected.
On OpenPOWER hosts, also review who has root inside guest partitions. The attack needs root on a guest, so shared hosting or multi-team guests carry the most risk.
What to do now
- Identify Power systems that run OpenPOWER rather than PowerVM.
- Read their firmware levels and compare with the affected ranges.
- Download FW950.H3, OP940.a2 or OP940.82 as applicable from Fix Central.
- Schedule firmware updates in a maintenance window, since firmware changes need planning.
- Keep note of the recovery step IBM describes: clearing NVRAM through the service processor.
Why it matters
CWE-125 is an out-of-bounds read, here in the firmware code that parses NVRAM. A guest partition root user can write a crafted NVRAM image, and the host's boot stage reads it wrongly, causing a crash and possible memory corruption. The condition persists until an operator clears NVRAM through the service processor.
That persistence is the notable part. A crash at boot is not fixed by a restart, so recovery takes hands-on access. Scope is changed, because a guest affects the host. Tenants who share OpenPOWER hardware should treat host firmware as part of their shared risk.
The weakness class here is CWE-125 (Out-of-bounds Read). The NVD record scores it 7.3, which is high severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector with local access, low attack complexity, low privileges required, no user interaction. Scope is changed, meaning the impact can reach beyond the vulnerable component. Impact on confidentiality, integrity and availability is rated none, low and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
Are PowerVM systems affected?
No. IBM says only OpenPOWER systems are affected, and systems running PowerVM are not.
Sources
- IBM security bulletin for Power firmware
- Safeguard Gold entry for CVE-2026-17042, which summarizes the NVD record
Last reviewed: 18 October 2026.
