CVE-2026-85508

A stack-based buffer overflow exists in FreeIPMI's ipmi-oem tool, in the Dell OEM handler for the get-system-info cmc-ipv6-info subcommand. The vulnerable function _output_dell_system_info_cmc_ipv6_info uses a 256-byte stack buffer but allows up to 65536 bytes of data to be copied from a BMC response without proper bounds checking.

This flaw has limited practical impact for several reasons: (1) ipmi-oem is a client-side command-line tool run manually by administrators, not a listening service or daemon — exploitation requires a user to actively run the specific Dell OEM subcommand against a compromised or malicious BMC; (2) IPMI communication typically occurs over a dedicated out-of-band management network, not the general Internet; (3) Red Hat Enterprise Linux builds FreeIPMI with full hardening enabled (_hardened_build 1), including stack protector (-fstack-protector-strong), which detects stack buffer corruption and terminates the process before the return address can be hijacked — effectively limiting the impact to a client-side crash rather than code execution; (4) additional mitigations including PIE, full RELRO, and NX further hinder exploitation even if the stack canary were bypassed. Fix is available in FreeIPMI version 1.6.19.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not run ipmi-oem dell get-system-info subcommands (specifically idrac-info, cmc-info, and cmc-ipv6-info) against untrusted or unverified BMC endpoints. Restrict IPMI management network access to trusted administrators and trusted BMC controllers only. If the ipmi-oem Dell OEM subcommands are not needed, avoid using them entirely.