CVE-2026-85507 in FreeIPMI
Summary
by MITRE • 09/04/2026
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified as CVE-2023-48765 resides within the FreeIPMI software suite, specifically affecting versions prior to 1.6.19 in the ipmi-oem component. This security flaw is classified as a stack-based buffer overflow located within the _output_dell_system_info_cmc_info function found in the source file ipmi-oem/ipmi-oem-dell.c. The issue manifests when executing the cmc-info subcommand associated with the dell get-system-info operation, which interacts with Dell hardware management controllers via the Intelligent Platform Management Interface protocol.
From a technical perspective, stack-based buffer overflows occur when a program writes more data to a fixed-length block of memory on the call stack than it is allocated to hold. In this specific instance, the _output_dell_system_info_cmc_info function fails to adequately validate or bound-check input data derived from the Dell Chassis Management Controller response before copying it into a local buffer. If an attacker can control the content and length of the system information returned by the BMC, they may supply a payload that exceeds the allocated stack space. This overflow allows for overwriting adjacent memory locations on the stack, including critical return addresses or function pointers. Such manipulation enables arbitrary code execution with the privileges of the process running FreeIPMI, potentially leading to complete compromise of the host system if exploited successfully.
The operational impact of this vulnerability is significant due to its potential for remote exploitation depending on the deployment context. While ipmi-oem is often used by administrators or automated scripts to query hardware status, many deployments involve privileged accounts interacting with BMCs that may be accessible over a network. If an attacker has access to the IPMI interface and can manipulate the response data from a compromised or maliciously configured Dell server's management controller, they could trigger this overflow remotely. This aligns with Common Weakness Enumeration category CWE-121, which covers stack-based buffer overflows resulting from improper size validation of input buffers. Furthermore, in the context of attack techniques, this vulnerability facilitates exploitation paths similar to those described under MITRE ATT&CK technique T1059, specifically command and script interpretation or execution through local system utilities, allowing an adversary to establish persistence or escalate privileges on the target machine.
Mitigation strategies primarily involve upgrading FreeIPMI to version 1.6.19 or later where this buffer overflow has been patched with proper bounds checking implemented in the affected function. Organizations relying on older versions should consider implementing network segmentation to restrict access to IPMI interfaces, ensuring that only trusted management stations can communicate with BMCs. Additionally, deploying intrusion detection systems capable of monitoring for anomalous memory access patterns or stack corruption indicators may provide an additional layer of defense against exploitation attempts until patching is completed. Regular auditing of third-party dependencies and maintaining up-to-date software inventories are essential practices to prevent exposure to such low-level system vulnerabilities that can lead to high-impact security breaches.