Stack-Based Buffer Over-Read Vulnerability in FreeIPMI from GNU
CVE-2026-85505

7.5HIGH

Key Information:

Vendor

Freeipmi

Status
Freeipmi
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85505?

The FreeIPMI software prior to version 1.6.19 contains a vulnerability in the ipmi_oem_fujitsu_get_sel_entry_long_text function, located in the ipmi-oem/ipmi-oem-fujitsu.c file. This vulnerability allows for a stack-based buffer over-read when a Baseboard Management Controller (BMC) provides an unexpectedly short response, which can lead to potential information exposure. The issue is notably distinct from other vulnerabilities and requires users to update to version 1.6.19 or later to mitigate the risk.

Affected Version(s)

FreeIPMI 0 < 1.6.19

References

https://www.openwall.com/lists/oss-security/2026/08/28/5
https://www.gnu.org/software/freeipmi/
https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.