CVE-2026-85509
Description
A flaw was found in FreeIPMI. This vulnerability involves a stack-based buffer overflow that occurs when a Baseboard Management Controller (BMC) sends an oversized response during data reading. An attacker could exploit this by tricking an administrator into running FreeIPMI commands against a malicious BMC. Successful exploitation could lead to arbitrary code execution, allowing the attacker to run their own code on the affected system.
Statement
FreeIPMI contains a stack-based buffer overflow triggered by oversized responses from a Baseboard Management Controller (BMC), potentially allowing arbitrary code execution. The severity is constrained to Moderate because the vulnerability cannot be exploited without direct administrative interaction. An attacker must possess a compromised BMC and rely on an administrator to explicitly execute FreeIPMI commands against it to trigger the vulnerable code path.
Mitigation
Restrict IPMI and BMC access to a dedicated, trusted management network so FreeIPMI clients cannot reach untrusted or compromised controllers. Please do not run ipmi-fru or bmc-device --read-fru against untrusted BMCs. If FRU inventory queries are not required, do not use those tools (or other libfreeipmi FRU callers) against remote management controllers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
