FreeIPMI CVE-2026-50031

Exploitation requires three specific conditions: (1) the victim must invoke the FreeIPMI ipmi-oem client with one of the two vulnerable subcommands - 'dell get-active-directory-config' or 'fujitsu get-sel-entry-long-text'; (2) the targeted IPMI endpoint must be attacker-controlled or sit on a network path where the attacker can inject or modify IPMI response messages (e.g., on-path on a management LAN, or a compromised BMC); and (3) the installed FreeIPMI version must be earlier than 1.16.18. Despite the CVSS PR:N/UI:N rating, the attack is in practice client-triggered: an unsolicited remote attacker cannot crash a victim who never runs the affected ipmi-oem subcommands, which significantly limits opportunistic exploitation.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 and reflects only availability impact, which is consistent with a stack overflow that crashes the client rather than a confirmed RCE primitive - though stack overflows of this class can sometimes be escalated to code execution depending on compiler hardening (stack canaries, ASLR, FORTIFY_SOURCE) on the distribution build. The CVSS vector indicates UI:N and PR:N, but in practice exploitation requires a user to voluntarily run ipmi-oem against a malicious or hijacked BMC, which is a meaningful real-world limiter that the CVSS score does not capture. EPSS data was not provided, the CVE is not in CISA KEV, and no public PoC was referenced, so prioritization should treat this as a moderate management-station hygiene issue rather than an internet-facing emergency; however, organizations whose admins routinely point ipmi-oem at untrusted or shared BMCs (hosting, colo, lab fleets) should patch promptly.

An attacker who controls a BMC (for example, a compromised server in a shared colocation rack, a malicious device on a management VLAN, or an ARP/DNS-spoofed BMC IP) waits for an administrator to run 'ipmi-oem dell get-active-directory-config' or 'ipmi-oem fujitsu get-sel-entry-long-text' against it. The malicious BMC returns a crafted oversized response that overflows a stack buffer in the ipmi-oem process, crashing the admin's management tooling and, depending on the build's stack protections, potentially corrupting the return address for further exploitation. No public exploit identified at time of analysis.