TI-2026-10256 Aliases CVE-2026-11885 GHSA-f687-cr2f-7jv7

Power System update in Buffer Copy

LOW 35CWE-120Published 2026-07-30 · Updated 2026-07-30

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1 A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to crash or compromise OS memory integrity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00148 4th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	PowerVM Hypervisor	FW1110.00 – FW1110.20; FW1060.00 – FW1060.71; FW950.00 – FW950.H1	—	No fix listed	CNA

PowerVM Hypervisor VendorIBM Affected FW1110.00 – FW1110.20; FW1060.00 – FW1060.71; FW950.00 – FW950.H1 Fixed in — No fix listed CNA

CPE configurations NVD · 60

CPE	Versions	Role	Vendor
cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware::::::::	fw1110.00 to before fw1110.30	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1122_\(9824-22a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware::::::::	fw1110.00 to before fw1110.30	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1124_\(9824-42a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware::::::::	fw1110.00 to before fw1110.30	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1122s_\(9824-22b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware::::::::	fw1110.00 to before fw1110.30	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1114_\(9824-41b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware::::::::	fw1110.00 to before fw1110.30	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1122_\(9856-22h\):-:::::::*	not specified by NVD	Running on	IBM

cpe:2.3:o:ibm:power_system_s1122_\(9824-22a\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.30 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1122_\(9824-22a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1124_\(9824-42a\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.30 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1124_\(9824-42a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1122s_\(9824-22b\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.30 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1122s_\(9824-22b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1114_\(9824-41b\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.30 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1114_\(9824-41b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l1122_\(9856-22h\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.30 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1122_\(9856-22h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Show 50 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware::::::::	fw1110.00 to before fw1110.30	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1124_\(9856-42h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware::::::::	fw1110.00 to before fw1110.30	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e1150_\(9043-mru\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1022_\(9105-22a\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1022_\(9105-22a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1024_\(9105-42a\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1024_\(9105-42a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1022s_\(9105-22b\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1022s_\(9105-22b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1014_\(9105-41b\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1014_\(9105-41b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l1022_\(9786-22h\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1022_\(9786-22h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l1024_\(9786-42h\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l1024_\(9786-42h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e1050_\(9043-mrx\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e1050_\(9043-mrx\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s1012_\(9028-21b\)_firmware::::::::	fw1060.00 to before fw1060.72	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s1012_\(9028-21b\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware::::::::	fw1110.00 to before fw1110.30	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_l922_\(9008-22l\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_l922_\(9008-22l\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s922_\(9009-22a\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s922_\(9009-22a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_h922_\(9223-22h\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_h922_\(9223-22h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s914_\(9009-41a\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s914_\(9009-41a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s924_\(9009-42a\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s924_\(9009-42a\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_h924_\(9223-42h\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_h924_\(9223-42h\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:::::::*	not specified by NVD	Running on	IBM
cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware::::::::	fw950.00 to before fw950.h2	Vulnerable	IBM
cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:::::::*	not specified by NVD	Running on	IBM

cpe:2.3:o:ibm:power_system_l1124_\(9856-42h\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.30 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1124_\(9856-42h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e1150_\(9043-mru\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.30 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e1150_\(9043-mru\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e1080_\(9080-hex\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e1080_\(9080-hex\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1022_\(9105-22a\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1022_\(9105-22a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1024_\(9105-42a\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1024_\(9105-42a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1022s_\(9105-22b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1022s_\(9105-22b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1014_\(9105-41b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1014_\(9105-41b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l1022_\(9786-22h\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1022_\(9786-22h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l1024_\(9786-42h\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l1024_\(9786-42h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e1050_\(9043-mrx\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e1050_\(9043-mrx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s1012_\(9028-21b\)_firmware:*:*:*:*:*:*:*:* Versions fw1060.00 to before fw1060.72 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s1012_\(9028-21b\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e1180_\(9080-heu\)_firmware:*:*:*:*:*:*:*:* Versions fw1110.00 to before fw1110.30 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e1180_\(9080-heu\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e980_\(9080-m9s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e980_\(9080-m9s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_l922_\(9008-22l\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_l922_\(9008-22l\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s922_\(9009-22a\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s922_\(9009-22a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s922_\(9009-22g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s922_\(9009-22g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_h922_\(9223-22h\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_h922_\(9223-22h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_h922_\(9223-22s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_h922_\(9223-22s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s914_\(9009-41a\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s914_\(9009-41a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s914_\(9009-41g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s914_\(9009-41g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s924_\(9009-42a\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s924_\(9009-42a\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_s924_\(9009-42g\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_s924_\(9009-42g\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_h924_\(9223-42h\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_h924_\(9223-42h\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_h924_\(9223-42s\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_h924_\(9223-42s\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
cpe:2.3:o:ibm:power_system_e950_\(9040-mr9\)_firmware:*:*:*:*:*:*:*:* Versions fw950.00 to before fw950.h2 Vulnerable ·IBM
cpe:2.3:h:ibm:power_system_e950_\(9040-mr9\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-11885
2026-10-03 Alias added: GHSA-f687-cr2f-7jv7

References

Patch 1

https://www.ibm.com/support/pages/node/7280628

TI-2026-15412 Power System Out-of-bounds Write CVSS 3.1HIGH 8.8
TI-2026-14313 Power System Improper Input Validation CVSS 3.1HIGH 8.8
TI-2026-06926 This Power System update is being released to address incorrect authorization CVSS 3.1HIGH 8.8
TI-2026-15705 Power System Buffer Overflow CVSS 3.1HIGH 8.2
TI-2026-14226 Power System Out-of-bounds Write CVSS 3.1HIGH 8.2
TI-2026-14221 Power System Buffer Overflow CVSS 3.1HIGH 8.2

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences