CVE-2026-85509
Received Received - Intake

Stack-Based Buffer Overflow in FreeIPMI

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: MITRE

Description
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85509
EUVD
EUVD-2026-70887

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freeipmi freeipmi to 1.6.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeIPMI before version 1.6.19 contains a stack-based buffer overflow vulnerability in the _read_fru_data function located in libfreeipmi/fru/ipmi-fru.c. This flaw occurs when a Baseboard Management Controller (BMC) returns more data bytes than the system requested, potentially causing a buffer overflow.

Detection Guidance

This vulnerability can be detected by checking the version of FreeIPMI installed on your system. If the version is below 1.6.19, the system is vulnerable. Use the command 'ipmi-fru --version' or 'freeipmi --version' to check the installed version.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code, gain unauthorized access to the system, or cause a denial of service. The high CVSS score of 9.8 indicates it is critical and can be exploited remotely without authentication.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if FreeIPMI is used in systems handling sensitive data. A stack-based buffer overflow may lead to unauthorized access or data breaches, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update FreeIPMI to version 1.6.19 or later to address the stack-based buffer overflow in the FRU data handling component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart