CVE-2026-85508

FreeIPMI before 1.6.19 contains a stack-based buffer overflow (CWE-121) in the function _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c, reached via the 'cmc-ipv6-info' subcommand of 'ipmi-oem dell get-system-info'. The flaw is triggered when the ipmi-oem client parses a response from a Dell CMC/iDRAC-style BMC whose IPv6 info data is longer than the fixed stack buffer, so an attacker who controls a BMC or can spoof/intercept BMC responses on the management network can overflow the stack of the client process. Successful exploitation can crash ipmi-oem or execute arbitrary code with the privileges of the user running the tool, consistent with the CVSS 9.8 network-vector rating. Affected users are those running FreeIPMI older than 1.6.19 and querying Dell system information with this specific OEM subcommand, typically administrators in datacenter, HPC, or out-of-band management environments. There is currently no public PoC, no CISA KEV listing, and a low EPSS score (0.4% in 30 days), with no reports of in-the-wild exploitation.

What to do: Upgrade to FreeIPMI 1.6.19 or later, which fixes the overflow in ipmi-oem/ipmi-oem-dell.c. Until then, avoid running 'ipmi-oem dell get-system-info ... cmc-ipv6-info' against BMCs you do not fully trust, and restrict access to IPMI/BMC management networks to trusted administrators to prevent spoofed BMC responses.