Skip to main content

FreeIPMI CVE-2026-50031

| EUVDEUVD-2026-34065 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-06-03 mitre GHSA-qh2m-553j-rjfc
Buffer Overflow Dell Stack Overflow Freeipmi
7.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jun 03, 2026 - 05:00 EUVD
Analysis Generated
Jun 03, 2026 - 04:14 vuln.today

DescriptionCVE.org

ipmi-oem in FreeIPMI before 1.16.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands "ipmi-oem dell get-active-directory-config" and "ipmi-oem fujitsu get-sel-entry-long-text" were found to have exploitable buffer overflows on response messages.

AnalysisAI

Denial of service in FreeIPMI versions before 1.16.18 allows remote attackers to crash the ipmi-oem client by sending malformed IPMI response messages that trigger stack-based buffer overflows in the 'dell get-active-directory-config' and 'fujitsu get-sel-entry-long-text' subcommands. The flaw is client-side: a victim must invoke the affected subcommand against an attacker-controlled or compromised IPMI endpoint. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

FreeIPMI is the GNU implementation of the Intelligent Platform Management Interface (IPMI) specification, providing tools such as ipmi-sensors, ipmipower, and ipmi-oem for out-of-band server management. The ipmi-oem utility extends the base IPMI protocol with vendor-specific OEM commands, and in this case it parses response payloads returned by Dell (get-active-directory-config) and Fujitsu (get-sel-entry-long-text) BMCs. The root cause is CWE-121 (Stack-based Buffer Overflow): the client copies variable-length response fields into fixed-size stack buffers without sufficient length validation, so an oversized or malformed response from the remote BMC overflows the stack frame of the ipmi-oem process.

RemediationAI

Vendor-released patch: upgrade FreeIPMI to 1.16.18 or later, available via the GNU project release announcement at https://lists.gnu.org/archive/html/info-gnu/2026-06/msg00000.html and tracked in Savannah bugs 68363 and 68364. Where immediate upgrade is not possible, the most effective compensating control is operational: avoid running 'ipmi-oem dell get-active-directory-config' and 'ipmi-oem fujitsu get-sel-entry-long-text' against BMCs whose firmware integrity and network path you do not control, and restrict ipmi-oem use to management networks segmented from untrusted tenants - the trade-off is loss of those specific OEM query capabilities until patched. Distribution users should monitor their package vendor (Debian, Red Hat, SUSE, Ubuntu) for backported builds rather than waiting for the major version bump.

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Debian

freeipmi
Release Status Fixed Version Urgency
bullseye vulnerable 1.6.6-4+deb11u1 -
bookworm vulnerable 1.6.10-1 -
trixie vulnerable 1.6.15-1 -
forky, sid vulnerable 1.6.17-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-50031 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy