CVE-2026-85508
Received Received - Intake

Stack-based Buffer Overflow in FreeIPMI ipmi-oem

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: MITRE

Description
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85508
EUVD
EUVD-2026-70886

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freeipmi ipmi-oem to 1.6.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow vulnerability in the ipmi-oem tool of FreeIPMI versions before 1.6.19. It occurs in the _output_dell_system_info_cmc_ipv6_info function when processing the cmc-ipv6-info subcommand to dell get-system-info.

Detection Guidance

This vulnerability is specific to FreeIPMI versions before 1.6.19 and involves a stack-based buffer overflow in the ipmi-oem command when using the dell get-system-info subcommand with cmc-ipv6-info. To detect it, check your FreeIPMI version with 'ipmi-oem --version'. If it is below 1.6.19, the system is vulnerable. Additionally, monitor for crashes or unusual behavior when running 'ipmi-oem dell get-system-info cmc-ipv6-info'.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service by sending specially crafted input. It has a high impact on confidentiality, integrity, and availability of affected systems.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. Organizations using vulnerable versions of FreeIPMI may face regulatory penalties or legal consequences.

Mitigation Strategies

Update FreeIPMI to version 1.6.19 or later to address the stack-based buffer overflow in ipmi-oem.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart