CVE-2026-85504

FreeIPMI versions before 1.6.19 contain a stack-based buffer overflow (CWE-121) in the function _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c, which decodes Fujitsu iRMC OEM System Event Log (SEL) entries into long text descriptions. The flaw is triggered when FreeIPMI processes a malformed or oversized SEL long-text response supplied by a Fujitsu iRMC BMC, for example when the tool queries a compromised or spoofed BMC on the management network. With a CVSS 3.1 score of 9.8 (network vector, no privileges or user interaction required), a successful attack can compromise confidentiality, integrity, and availability, most plausibly through a crash or code execution in the process parsing the response. Anyone running FreeIPMI prior to 1.6.19 and using it to manage or monitor Fujitsu PRIMERGY servers with iRMC controllers is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates a 0.4% probability of exploitation within 30 days (32nd percentile).

What to do: Upgrade to FreeIPMI 1.6.19 or later, or install a distribution security update with the fix backported. Until patched, avoid running SEL decoding/queries (e.g., ipmi-sel) against Fujitsu iRMC BMCs and restrict the IPMI management network (UDP 623) to trusted hosts. Audit which hosts have FreeIPMI installed and whether they are used to monitor Fujitsu PRIMERGY/iRMC hardware.