ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info… (CVE-2026-85507)

The ipmi-oem module in FreeIPMI versions prior to 1.6.19 contains a stack-based buffer overflow vulnerability in the _output_dell_system_info_cmc_info function, which is part of the cmc-info subcommand used to retrieve Dell system information. This vulnerability (CVE-2026-85507) allows an unauthenticated remote attacker to execute arbitrary code or cause a denial of service due to the buffer overflow. The CVSS 3.1 score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no patch links are currently provided.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, leading to full compromise including confidentiality, integrity, and availability impacts. This could result in system crashes or takeover of the affected FreeIPMI service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor FreeIPMI vendor communications for updates. Until a fix is available, avoid exposing the vulnerable service to untrusted networks or restrict access to trusted administrators only.