CVE-2026-85509

A flaw was found in FreeIPMI. This vulnerability involves a stack-based buffer overflow that occurs when a Baseboard Management Controller (BMC) sends an oversized response during data reading. An attacker could exploit this by tricking an administrator into running FreeIPMI commands against a malicious BMC. Successful exploitation could lead to arbitrary code execution, allowing the attacker to run their own code on the affected system.

FreeIPMI contains a stack-based buffer overflow triggered by oversized responses from a Baseboard Management Controller (BMC), potentially allowing arbitrary code execution. The severity is constrained to Moderate because the vulnerability cannot be exploited without direct administrative interaction. An attacker must possess a compromised BMC and rely on an administrator to explicitly execute FreeIPMI commands against it to trigger the vulnerable code path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict IPMI and BMC access to a dedicated, trusted management network so FreeIPMI clients cannot reach untrusted or compromised controllers. Please do not run ipmi-fru or bmc-device --read-fru against untrusted BMCs. If FRU inventory queries are not required, do not use those tools (or other libfreeipmi FRU callers) against remote management controllers.