FreeIPMI up to 1.6.18 Fru ipmi-fru.c _read_fru_data stack-based overflow

Summaryinfo

A vulnerability marked as very critical has been reported in FreeIPMI up to 1.6.18. This affects the function _read_fru_data of the file libfreeipmi/fru/ipmi-fru.c of the component Fru. The manipulation leads to stack-based overflow. This vulnerability is referenced as CVE-2026-85509. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in FreeIPMI up to 1.6.18. This issue affects the function _read_fru_data of the file libfreeipmi/fru/ipmi-fru.c of the component Fru. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.

It is possible to read the advisory at openwall.com. The identification of this vulnerability is CVE-2026-85509 since 09/04/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/04/2026).

Upgrading to version 1.6.19 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• FreeIPMI

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17
• 1.6.18

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion