FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in… (CVE-2026-85504)

FreeIPMI prior to version 1.6.19 is affected by several stack-based buffer overflow vulnerabilities and one buffer over-read vulnerability in its IPMI OEM modules. Specifically, CVE-2026-85504 describes a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text due to malformed Fujitsu SEL long-text responses. CVE-2026-85505 is a buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text when a BMC returns a short response. CVE-2026-85506, CVE-2026-85507, and CVE-2026-85508 are stack-based buffer overflows in Dell-specific subcommands handling system info. CVE-2026-85509 is a stack-based buffer overflow in _read_fru_data when a BMC returns more bytes than requested. These vulnerabilities can lead to denial of service or arbitrary code execution. The issues are fixed in FreeIPMI 1.6.19.

Successful exploitation of these vulnerabilities can result in denial of service or arbitrary code execution on systems running vulnerable FreeIPMI versions. The vulnerabilities affect critical IPMI management functions, potentially allowing attackers to compromise system management interfaces remotely without authentication. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability.

A security update is available in FreeIPMI version 1.6.19 that addresses these vulnerabilities. Users should upgrade to version 1.6.19 or later to remediate these issues. No additional mitigation steps are indicated by the vendor advisory.