openUBMC CVE-2026-65200

Exploitation requires an attacker-controlled device on the internal management bus that can return crafted MCTP responses - specifically any PLDM endpoint (reaching the base, non-vendor PLDM control class) or a Huawei NIC speaking NCSI-over-MCTP (reaching the Huawei NCSI driver). The attacker must be able to send an undersized PLDM-over-MCTP or NCSI-over-MCTP response whose length is smaller than the fixed header/reserved-field size the parser subtracts. Explicitly NOT reachable via this CVE is the vendor-specific wangxun parser, which is tracked separately. The decisive limiting factor is physical/on-bus access (AV:P): the attacker must already have a malicious or compromised device on the management bus, so this is not remotely exploitable over the network and not reachable from a normal host OS or external interface.

This is a genuinely low-priority issue, and the available signals agree rather than conflict. The provided CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, base 3.5) centers on the physical attack vector: exploitation requires a malicious or compromised device already present on the internal management (MCTP) bus, which is the dominant risk-limiting factor. The impact is modest - low confidentiality (out-of-bounds read leaking adjacent BMC memory) and low availability (parser crash), with no integrity impact. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. There is no CISA KEV listing and no public exploit referenced, so the exploitation status is: no public exploit identified at time of analysis. The only intelligence source is a single runZero advisory reporting the flaw; this appears to be a researcher-discovered memory-safety bug rather than an actively targeted vulnerability. Net: despite being a real out-of-bounds read, the physical/on-bus prerequisite and low impact make this a low-urgency patch, not a drop-everything issue.

An attacker who has implanted or compromised a device on the server's internal management bus (a PLDM endpoint or a Huawei NIC presenting NCSI-over-MCTP) returns a deliberately undersized response to the openUBMC device-management process. The parser subtracts a fixed header/reserved-field size without a lower-bound check, underflowing the unsigned length to a huge value and reading far past the response buffer, leaking adjacent BMC memory or crashing the process. No public exploit code is referenced, and the physical-bus requirement (AV:P) makes this a constrained, access-dependent attack.