CVE-2026-85504

A flaw was found in FreeIPMI. This vulnerability, a stack-based buffer overflow, occurs when the software processes malformed Fujitsu System Event Log (SEL) responses. An attacker could exploit this by providing specially crafted SEL data, potentially requiring user interaction, to achieve arbitrary code execution.

A stack-based buffer overflow in FreeIPMI allows for arbitrary code execution when processing malformed Fujitsu System Event Log (SEL) responses. This vulnerability is restricted to a Moderate severity rating due to its elevated attack complexity: successful exploitation requires an attacker to successfully inject specially crafted SEL data and relies on active user interaction to trigger the vulnerable code path, significantly lowering the likelihood of an automated or widespread attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict IPMI and BMC access to a dedicated, trusted management network so FreeIPMI SEL tools cannot reach untrusted or compromised Fujitsu controllers. Please do not run ipmi-sel with OEM interpretation (--interpret-oem-data) against untrusted BMCs, and do not enable interpret-oem-data in ipmiseld for those hosts. If Fujitsu OEM long-text SEL decoding is not required, leave that option off.