CVE-2026-65200: CWE-191 Integer underflow (wrap or wraparound) in Huawei openBMC

Huawei openBMC's device-management process contains an integer underflow (CWE-191) vulnerability in three response parsers within shared transport libraries. These parsers subtract fixed header or reserved-field sizes from device-supplied response lengths without validating that the result is non-negative. If the response length is undersized, the subtraction causes an unsigned integer wraparound, resulting in a very large length value. Consequently, the parser reads far beyond the allocated response buffer, potentially causing memory corruption. The affected code is in the base PLDM control class and Huawei's NCSI driver, thus accessible via any PLDM endpoint or Huawei NIC on the internal management bus. The vulnerability affects versions from 0 up to and including 26.06. The CVSS v3.1 base score is 3.5 (low severity), with attack vector as physical, low attack complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact. No known exploits have been reported.

The vulnerability allows a parser in Huawei openBMC to read beyond the bounds of a response buffer due to an integer underflow in length calculation. This can lead to memory corruption and potentially cause availability issues. The confidentiality impact is low, and there is no impact on integrity. Exploitation requires physical access to the internal management bus, and no privileges or user interaction are needed. No known exploits are currently in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit physical access to the internal management bus and restrict untrusted devices from connecting to PLDM endpoints or Huawei NICs on the management bus.