ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c… (CVE-2026-85505)

The ipmi-oem module in FreeIPMI versions prior to 1.6.19 contains a stack-based buffer over-read vulnerability in the ipmi_oem_fujitsu_get_sel_entry_long_text function located in ipmi-oem/ipmi-oem-fujitsu.c. This occurs when the BMC returns a response shorter than expected, leading to reading beyond the allocated buffer on the stack. The vulnerability is classified under CWE-125 (Out-of-bounds Read). It differs from CVE-2026-50031, which affects different versions and is a separate issue. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

Successful exploitation results in a stack-based buffer over-read that can cause a denial of service by crashing the affected application. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability can be triggered remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users of FreeIPMI should monitor vendor communications for updates and apply any official patches once released. Until then, consider limiting exposure of the affected service to untrusted networks if possible.