CVE-2026-85507

FreeIPMI versions before 1.6.19 contain a stack-based buffer overflow (CWE-121) in the function _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c. The flaw is triggered when the ipmi-oem tool runs the 'dell get-system-info cmc-info' subcommand and parses the Chassis Management Controller (CMC) information returned by a Dell BMC, so an attacker who controls or can spoof the BMC's response (for example via a compromised or MITM'd management controller) could overflow the stack buffer in the tool. Successful exploitation could lead to arbitrary code execution in the context of the user running ipmi-oem, or at minimum a crash, consistent with the critical CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N, high impact on confidentiality, integrity, and availability). Administrators and operators who use FreeIPMI to manage Dell PowerEdge chassis and servers are affected; deployments of other vendors' hardware using the Dell OEM subcommand path are not implicated by this specific code path. There is currently no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days, so no exploitation is known.

What to do: Upgrade to FreeIPMI 1.6.19 or later, which fixes the overflow in _output_dell_system_info_cmc_info. As an interim mitigation, avoid running 'ipmi-oem dell get-system-info cmc-info' against BMCs you do not trust and restrict access to IPMI/BMC management networks. Verify the installed FreeIPMI version via your package manager and prioritize hosts that routinely run Dell OEM queries against shared or remotely reachable management controllers.