Skip to main content

FreeIPMI EUVDEUVD-2026-70883

| CVE-2026-85505 HIGH
Out-of-bounds Read (CWE-125)
2026-09-04 mitre GHSA-386j-5xxr-g7c7
Buffer Overflow Red Hat Suse Freeipmi
7.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

AC:H reflects the requirement to control BMC responses via a compromised BMC or MITM on the management network; all other metrics align with vendor assessment.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch available
Sep 04, 2026 - 06:01 EUVD
Metadata Corrected
Sep 04, 2026 - 05:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Analysis Generated
Sep 04, 2026 - 05:09 vuln.today
CVE Published
Sep 04, 2026 - 04:16 cve.org
HIGH 7.5

DescriptionCVE.org

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).

AnalysisAI

Stack-based buffer over-read in FreeIPMI's ipmi-oem Fujitsu OEM module crashes the client process when a Fujitsu BMC returns a shorter-than-expected response to a System Event Log query. All FreeIPMI versions before 1.6.19 are affected; this is a distinct vulnerability from CVE-2026-50031, which covers different version ranges. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) the target system running FreeIPMI before 1.6.19; (2) active use of the ipmi-oem subcommand against a Fujitsu BMC specifically querying SEL entries via the Fujitsu OEM extension; and (3) attacker ability to control the BMC response - either via direct compromise of the Fujitsu BMC hardware, or by holding a MITM position on the IPMI management network to intercept and replace the response with a short payload. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) presents this as an unauthenticated network DoS with low complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade FreeIPMI to version 1.6.19 or later; the patched source tarball is available at https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running FreeIPMI prior to version 1.6.19 that interact with Fujitsu BMCs and determine their operational criticality to your infrastructure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Freeipmi

View all
CVE-2026-85509 CRITICAL
9.8 Sep 04

Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs
CVE-2026-85508 CRITICAL
9.8 Sep 04

Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv
CVE-2026-85507 CRITICAL
9.8 Sep 04

Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client
CVE-2026-85506 CRITICAL
9.8 Sep 04

Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell
CVE-2026-85504 CRITICAL
9.8 Sep 04

Stack-based buffer overflow in GNU FreeIPMI before 1.6.19 lets a malicious or compromised Fujitsu iRMC BMC corrupt clien
CVE-2026-50031 HIGH
7.5 Jun 03

Denial of service in FreeIPMI versions before 1.16.18 allows remote attackers to crash the ipmi-oem client by sending ma

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

EUVD-2026-70883 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy