CVE-2026-17042 Power System Out-of-bounds Read

High 7.3 Published 19 Aug 2026 Updated 19 Aug 2026

A root user in a guest partition can crash the host firmware via crafted NVRAM, causing denial of service and potential memory corruption on OpenPOWER systems.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-17042?

CVE-2026-17042 is a high-severity memory corruption vulnerability in IBM Power Systems Firmware, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

Weakness: CWE-125

Which versions are affected by CVE-2026-17042?

It affects 10 products.

Products include Ibm Power Hardware Management Console \(7063-Cr2\) Firmware, Ibm Power System Ac922 \(8335-Gth\) Firmware, Ibm Power System Ac922 \(8335-Gtx\) Firmware, Ibm Power System E950 \(9040-Mr9\) Firmware, Ibm Power System E980 \(9080-M9s\) Firmware, Ibm Power System H922 \(9223-22s\) Firmware and 4 more.

How do I fix CVE-2026-17042?

No fix has been published for CVE-2026-17042 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-17042 being exploited?

There is no known exploitation of CVE-2026-17042 in the wild and no public exploit code.

Sources

Also known as GHSA-rcv3-hw8m-43fg.