CVE-2026-85505

CVE-2026-85505 is a stack-based buffer over-read (CWE-125) in the ipmi-oem utility of FreeIPMI, located in the function ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c. It is triggered when the tool issues a Fujitsu OEM SEL (system event log) long-text query and the BMC returns a response shorter than expected, causing the client to read past the end of a stack buffer. An attacker who controls or compromises the BMC, or who can tamper with BMC responses, can crash the ipmi-oem client process; per the CVSS 3.1 score only availability is impacted (C:N/I:N/A:H), so this is a denial-of-service issue rather than code execution or data exposure. Affected users are administrators running FreeIPMI versions before 1.6.19 who invoke the Fujitsu OEM commands in ipmi-oem; this flaw is distinct from CVE-2026-50031, which affects different versions of the software. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS puts exploitation probability in the next 30 days at about 0.3%, so no exploitation is currently known.

What to do: Upgrade to FreeIPMI 1.6.19, or install a distribution package that includes that release, and verify the installed version via your package manager. As an interim mitigation, avoid running ipmi-oem Fujitsu SEL long-text queries against BMCs you do not fully trust and keep BMC access restricted to management networks. No public PoC or in-the-wild exploitation is known, so patching can follow normal maintenance cycles, prioritizing hosts that routinely query Fujitsu BMCs.