CVE-2026-85505

A stack-based out-of-bounds read vulnerability was found in the FreeIPMI ipmi-oem utility. When processing an abnormally short response from a Baseboard Management Controller (BMC), the application over-reads the buffer. A malicious BMC could exploit this to crash the client application (Denial of Service) or potentially leak stack memory. Red Hat compiler safeguards further restrict the impact primarily to a process crash.

A flaw in the ipmi_oem_fujitsu_get_sel_entry_long_text function of FreeIPMI allows an out-of-bounds read. If a BMC returns an unexpectedly truncated System Event Log (SEL) response, the client fails to validate the data length before reading. This causes the application to read past the allocated stack buffer boundaries, leading to a crash or potential memory disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict IPMI and BMC access to a dedicated, trusted management network so ipmi-oem cannot reach untrusted or compromised Fujitsu controllers. Until a fixed freeipmi package is installed, do not run ipmi-oem fujitsu get-sel-entry-long-text against untrusted BMCs. If that OEM SEL long-text query is not required, do not use ipmi-oem against remote management controllers.