The freeipmi software, which provides IPMI remote console and system management functionality, contains a buffer overflow vulnerability triggered by specially crafted response messages via the ipmi-oem interface (CVE-2026-33554). This vulnerability is classified under CWE-120 (buffer copy without checking size of input). Red Hat has released updated freeipmi packages for Red Hat Enterprise Linux 8 and related variants to fix this issue. The advisory rates the security impact as moderate and provides package updates for multiple hardware architectures. No CVSS score is provided in the advisory, and no exploits are currently known in the wild.

Successful exploitation of this buffer overflow could lead to memory corruption within the freeipmi service. The advisory does not specify further impact details such as privilege escalation or denial of service, but buffer overflows generally pose risks of application crashes or potential code execution. The issue affects multiple Red Hat Enterprise Linux 8 variants across various hardware platforms. No known active exploitation has been reported.

Red Hat has released updated freeipmi packages that address this vulnerability. Users and administrators of affected Red Hat Enterprise Linux 8 systems should apply the security update as described in the Red Hat advisory RHSA-2026:20579 and the referenced article https://access.redhat.com/articles/11258. Applying the official patch fully mitigates the vulnerability. There is no indication that additional mitigations or workarounds are required beyond installing the update.