CVE-2026-85508 ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
CriticalCVSS 9.8
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| FreeIPMI | < 1.6.19 | 1.6.19 |
| redhat/freeipmi(Red Hat:enterprise_linux:10.2) | < 1.6.20-1.el10_2 | 1.6.20-1.el10_2 |
| redhat/freeipmi(Red Hat:enterprise_linux:8) | < 1.6.20-1.el8_10 | 1.6.20-1.el8_10 |
| redhat/freeipmi(Red Hat:enterprise_linux:9) | < 1.6.20-1.el9_8 | 1.6.20-1.el9_8 |
| redhat/freeipmi(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/freeipmi(Red Hat:rhel_els:7) | All versions | No fix listed |
| debian/freeipmi(Debian:12) | All versions | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.10-1 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.10-2 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.11-1 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.11-2 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.13-1 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.13-2 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.13-2~bpo12+1 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.13-3 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.15-1 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.15-2 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.16-1 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.17-1 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.18-1 | No fix listed |
| debian/freeipmi(Debian:12) | = 1.6.19-1 | No fix listed |
| debian/freeipmi(Debian:13) | All versions | No fix listed |
| debian/freeipmi(Debian:13) | = 1.6.15-1 | No fix listed |
| debian/freeipmi(Debian:13) | = 1.6.15-2 | No fix listed |
| debian/freeipmi(Debian:13) | = 1.6.16-1 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/freeipmi(Debian:13) | = 1.6.17-1 | No fix listed |
| debian/freeipmi(Debian:13) | = 1.6.18-1 | No fix listed |
| debian/freeipmi(Debian:13) | = 1.6.19-1 | No fix listed |
| debian/freeipmi(Debian:14) | < 1.6.19-1 | 1.6.19-1 |
| debian/freeipmi(Debian:14) | = 1.6.15-1 | No fix listed |
| debian/freeipmi(Debian:14) | = 1.6.15-2 | No fix listed |
| debian/freeipmi(Debian:14) | = 1.6.16-1 | No fix listed |
| debian/freeipmi(Debian:14) | = 1.6.17-1 | No fix listed |
| debian/freeipmi(Debian:14) | = 1.6.18-1 | No fix listed |
| ubuntu/freeipmi(Ubuntu:22.04) | < 1.6.9-2ubuntu0.22.04.4 | 1.6.9-2ubuntu0.22.04.4 |
| ubuntu/freeipmi(Ubuntu:24.04) | < 1.6.13-3ubuntu0.2 | 1.6.13-3ubuntu0.2 |
| ubuntu/freeipmi(Ubuntu:26.04) | < 1.6.16-1ubuntu0.2 | 1.6.16-1ubuntu0.2 |
| azure linux freeipmi(Azure Linux:3.0) | < 1.6.19-1 | 1.6.19-1 |
References
- MSRC Security Update Guide vendor-advisory
- Security Update patch
- www.openwall.com
- www.gnu.org
- ftp.gnu.org
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:89905 patch vendor-advisory
- RHSA-2026:89754 patch vendor-advisory
- RHSA-2026:89753 patch vendor-advisory
- Red Hat Bugzilla 2528401 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-85508 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8843-1 vendor-advisory
- bugs.debian.org issue-tracking