CVE-2026-85505 in FreeIPMI
Summary
by MITRE • 09/04/2026
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The FreeIPMI project, specifically the ipmi-oem component prior to version 1.6.19, contains a stack-based buffer over-read vulnerability within the function ipmi_oem_fujitsu_get_sel_entry_long_text located in the source file ipmi-oem/ipmi-oem-fujitsu.c. This flaw arises from insufficient validation of data lengths when processing responses received from Baseboard Management Controllers manufactured by Fujitsu. The vulnerability is distinct from CVE-2026-50031, which affects different software versions and involves a separate code path or logic error, indicating that the FreeIPMI project has addressed multiple related but technically distinct issues in its subsequent releases.
From a technical perspective, this stack-based buffer over-read occurs when the application processes an Intelligent Platform Management Interface response where the BMC provides data shorter than expected by the parsing routine. The function ipmi_oem_fujitsu_get_sel_entry_long_text likely attempts to read or copy text entries from the Service Event Log without adequately checking if the provided length field accurately reflects the actual amount of valid data available in the buffer. When a BMC returns a truncated or short response, the code may proceed to access memory locations beyond the bounds of the allocated stack variable intended for storing the log entry. This results in reading arbitrary stack contents rather than causing a traditional out-of-bounds write that could lead to immediate exploitation via shellcode injection.
The operational impact of this vulnerability is primarily related to information disclosure and potential application instability. Because it is an over-read rather than an overwrite, direct remote code execution is less likely unless the leaked data can be leveraged in conjunction with other vulnerabilities or specific memory layout conditions such as those exploited by return-oriented programming techniques. However, reading uninitialized stack variables or sensitive data from adjacent stack frames can expose internal application state, cryptographic keys, or credentials stored on the stack to an attacker who controls the BMC input. In a managed environment where FreeIPMI tools are used for monitoring and management of server hardware, this could allow an adversary with access to the IPMI interface to gather intelligence about the host system's memory layout or sensitive data processed by the tool.
This vulnerability aligns with CWE-125, which describes Out-of-bounds Read, a category of flaws where software reads past the end of a buffer. In the context of attack frameworks such as MITRE ATT&CK, this behavior can be associated with techniques used for reconnaissance or credential harvesting, specifically under Tactic 1048: Exfiltration Over Alternative Protocol if the leaked data is transmitted out of band, though more commonly it falls under general exploitation patterns where memory corruption leads to information leakage. The specific interaction with Fujitsu BMCs highlights the risk inherent in OEM-specific implementations that may not adhere strictly to standard IPMI specifications regarding response length validation.
Mitigation strategies for this vulnerability involve upgrading FreeIPMI to version 1.6.19 or later, which includes patches addressing these boundary check deficiencies. Administrators should ensure that all systems running ipmi-oem components are updated through their respective package managers or source builds. In environments where immediate patching is not feasible, network segmentation restricting access to IPMI interfaces from untrusted networks can reduce the attack surface. Additionally, implementing strict input validation at the application level for any custom integrations using FreeIPMI libraries can help prevent processing of malformed BMC responses until official patches are applied. Regular auditing of system logs and monitoring for unusual memory usage patterns may also aid in detecting potential exploitation attempts involving this flaw.