{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85506", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-04T04:17:33.177Z", "datePublished": "2026-09-04T04:17:33.524Z", "dateUpdated": "2026-09-09T19:17:28.359Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "FreeIPMI", "vendor": "FreeIPMI", "versions": [{"lessThan": "1.6.19", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info)."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-04T04:17:33.524Z"}, "references": [{"url": "https://www.openwall.com/lists/oss-security/2026/08/28/5"}, {"url": "https://www.gnu.org/software/freeipmi/"}, {"url": "https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-09T19:17:09.151315Z", "id": "CVE-2026-85506", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T19:17:28.359Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-09T19:17:09.151315Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T19:17:24.998Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "FreeIPMI", "product": "FreeIPMI", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.openwall.com/lists/oss-security/2026/08/28/5"}, {"url": "https://www.gnu.org/software/freeipmi/"}, {"url": "https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-04T04:17:33.524Z"}}}, "cveMetadata": {"cveId": "CVE-2026-85506", "state": "PUBLISHED", "dateUpdated": "2026-09-09T19:17:28.359Z", "dateReserved": "2026-09-04T04:17:33.177Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-04T04:17:33.524Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FreeIPMI", "vendor": "FreeIPMI", "versions": [{"lessThan": "1.6.19", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info)."}], "id": "CVE-2026-85506", "lastModified": "2026-09-09T20:20:53.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85506", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-09T19:17:09.151315Z", "version": "2.0.3"}}]}, "published": "2026-09-04T05:17:16.290", "references": [{"source": "cve@mitre.org", "url": "https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz"}, {"source": "cve@mitre.org", "url": "https://www.gnu.org/software/freeipmi/"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/08/28/5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem", "id": "2528398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528398"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-121", "details": ["A flaw was found in FreeIPMI. This vulnerability, a stack-based buffer overflow in the `ipmi-oem` component, specifically within the `_get_dell_system_info_idrac_info` function, could allow an attacker to achieve arbitrary code execution. This occurs when processing the `idrac-info` subcommand to `dell get-system-info`."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, implement robust boundary checks before copying data to ensure the input size does not exceed the allocated stack buffer capacity. Developers should replace unsafe, unbounded memory functions (like strcpy or sprintf) with safe, length-restricted alternatives (such as strncpy or snprintf). Furthermore, deploying the application in environments that enforce compiler-based protections like stack canaries and Address Space Layout Randomization (ASLR) will prevent successful code execution"}, "name": "CVE-2026-85506", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "freeipmi", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "freeipmi", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "freeipmi", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "freeipmi", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "freeipmi", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-04T04:17:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85506\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85506\nhttps://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz\nhttps://www.gnu.org/software/freeipmi/\nhttps://www.openwall.com/lists/oss-security/2026/08/28/5"], "statement": "Important: This stack-based buffer overflow in the `ipmi-oem` utility of FreeIPMI can lead to arbitrary code execution. Exploitation requires a local user to execute a specially crafted `ipmi-oem` command, potentially when processing untrusted data from a remote source, resulting in a complete compromise of the system running FreeIPMI.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.19)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeIPMI", "source": "cna", "vendor": "FreeIPMI"}, "product": "freeipmi", "vendor": "freeipmi"}], "created": "2026-09-04T05:30:13.724588+00:00", "updated": "2026-09-04T06:00:11.117528+00:00", "vendors": ["freeipmi", "freeipmi$PRODUCT$freeipmi"]}