IBM OPENBMC firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 contain an out-of-bounds read vulnerability in the BMC firmware management interface. This vulnerability allows a host system with high privileges to cause the BMC firmware management service to crash or to read a limited portion of internal BMC memory. The impact affects confidentiality and availability of the managed system. The CVSS 3.1 base score is 3.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L), reflecting a low severity with local attack vector, low complexity, and required high privileges. No known exploits or patches are reported at this time.

The vulnerability can lead to a crash of the BMC firmware management service, causing availability disruption. Additionally, it allows limited unauthorized reading of internal BMC memory, impacting confidentiality. There is no indication of integrity impact. The attack requires local access with high privileges on the host system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the host system and BMC management interface to trusted administrators with appropriate privileges to minimize exploitation risk.