CVE-2026-85507
Received Received - Intake

Stack-Based Buffer Overflow in FreeIPMI ipmi-oem Dell CMC Info

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: MITRE

Description
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85507
EUVD
EUVD-2026-70885

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freeipmi ipmi-oem to 1.6.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in the ipmi-oem tool from FreeIPMI versions before 1.6.19. It occurs specifically in the _output_dell_system_info_cmc_info function when processing the cmc-info subcommand of the dell get-system-info command.

Detection Guidance

To detect this vulnerability, check if your FreeIPMI version is below 1.6.19. Run 'ipmi-oem --version' to verify the installed version. If vulnerable, update FreeIPMI immediately. No specific commands detect the stack overflow directly, but monitoring for crashes or unusual behavior in ipmi-oem with the dell get-system-info cmc-info subcommand may indicate exploitation attempts.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service by sending specially crafted input. It has a high impact on confidentiality, integrity, and availability of the affected system.

Compliance Impact

This vulnerability, a stack-based buffer overflow in ipmi-oem, could lead to unauthorized access, data exfiltration, or system compromise. Such risks may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by exposing sensitive information or disrupting critical systems.

Mitigation Strategies

Update FreeIPMI to version 1.6.19 or later to address the stack-based buffer overflow in ipmi-oem.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85507. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart