IBM PowerVM Hypervisor Buffer Overflow Vulnerability CVE-2026-11885

Vulnerability Overview CVE ID: CVE-2026-11885 Description: A specially crafted OS hypervisor call may cause the PowerVM hypervisor to crash or compromise system or OS memory integrity. CWE ID: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CVSS Source: IBM CVSS Base Score: 8.4 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Scope of Impact Affected Products: - PowerVM Hypervisor FW1110.00 - FW1110.20 - PowerVM Hypervisor FW1060.00 - FW1060.71 - PowerVM Hypervisor FW950.00 - FW950.H1 Remediation Power 11: - Install FW1110.30(1110_125) or a later version to remediate this vulnerability. - Affected products include: - IBM Power System E1180 (9080-HEU) - IBM Power System S1122 (9824-22A) - IBM Power System S1124 (9824-42A) - IBM Power System S1122s (9824-22B) - IBM Power System S1114 (9824-41B) - IBM Power System L1122 (9856-22H) - IBM Power System L1124 (9856-42H) - IBM Power System E1150 (9043-MRU) Power 10: - Install FW1060.72(1060_171)/FW1060.80(1060_180) or a later version to remediate this vulnerability. - Affected products include: - IBM Power System E1080 (9080-HEX) Power 10: - Install FW1060.72(1060_177)/FW1060.80(1060_185) or a later version to remediate this vulnerability. - Affected products include: - IBM Power System S1022 (9105-22A) - IBM Power System S1024 (9105-42A) - IBM Power System S1022s (9105-22B) - IBM Power System S1014 (9105-41B) - IBM Power System L1022 (9786-22H) - IBM Power System L1024 (9786-42H) - IBM Power System E1050 (9043-MRX) - IBM Power System S1012 (9028-21B) Power 9: - Install FW950.H2(950_222) or a later version to remediate this vulnerability. - Affected products include: - IBM Power System L922 (9008-22L) - IBM Power System S922 (9009-22A, 9009-22G) - IBM Power System H922 (9223-22H, 9223-22S) - IBM Power System S914 (9009-41A, 9009-41G) - IBM Power System S924 (9009-42A, 9009-42G) - IBM Power System H924 (9223-42H, 9223-42S) - IBM Power System E950 (9040-MR9) - IBM Power System E980 (9080-M95) Additional Information Workarounds and Mitigations: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Information: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer According to FIRST (Forum of Incident Response and Security Teams), the Common Vulnerability Scoring System (CVSS) is an "industry open standard" designed to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is," without any express or implied warranties. Customers are responsible for assessing the impact of any actual or potential security vulnerabilities. IBM periodically updates component records within its product portfolio and addresses vulnerabilities related to packages identified prior to their discovery, regardless of their CVE dates. The inclusion of older CVE IDs does not indicate that the referenced product has been used by IBM since that date, nor does it indicate that IBM was aware of the vulnerability prior to that date. We strive to keep customers informed of relevant vulnerabilities as referenced in our "Affected Products and Versions." The referenced products and versions are intended to represent only supported or expired products and support versions. Therefore, references to unsupported or extended support products and versions do not constitute a determination by IBM that they are unaffected by the vulnerability. References to unsupported versions do not impose an obligation on IBM to provide fixes for unsupported or extended support products or versions.

Goal Reached Thanks to every supporter — we hit 100%!

IBM PowerVM Hypervisor Buffer Overflow Vulnerability CVE-2026-11885

More from this source