CVE-2026-85508

EUVD-2026-70886
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.12%
Debian logo
Debian Releases
Debian Product
Codename
freeipmi
bookworm
vulnerable
forky
1.6.19-1
fixed
sid
1.6.20-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
freeipmi
bionic
Fixed 1.4.11-1.1ubuntu4.1+esm2
released
focal
Fixed 1.6.4-3ubuntu1.1+esm2
released
jammy
Fixed 1.6.9-2ubuntu0.22.04.4
released
noble
Fixed 1.6.13-3ubuntu0.2
released
resolute
Fixed 1.6.16-1ubuntu0.2
released
trusty
Fixed 1.1.5-3ubuntu3.3+esm2
released
xenial
Fixed 1.4.11-1.1ubuntu4.1~0.16.04.1~esm2
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
freeipmi
suse enterprise desktop 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP7
1.6.8-150400.3.6.1
fixed
freeipmi-devel
suse enterprise desktop 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP7
1.6.8-150400.3.6.1
fixed
freeipmi-ipmiseld
suse enterprise desktop 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP7
1.6.8-150400.3.6.1
fixed
libfreeipmi17
suse enterprise desktop 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP7
1.6.8-150400.3.6.1
fixed
libipmiconsole2
suse enterprise desktop 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP7
1.6.8-150400.3.6.1
fixed
libipmidetect0
suse enterprise desktop 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP7
1.6.8-150400.3.6.1
fixed
libipmimonitoring6
suse enterprise desktop 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise sap 15 SP7
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP4
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP5
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP6
1.6.8-150400.3.6.1
fixed
suse enterprise server 15 SP7
1.6.8-150400.3.6.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
freeipmi
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-bmc-watchdog
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-bmc-watchdog-debuginfo
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-debuginfo
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-debugsource
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-devel
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-ipmidetectd
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-ipmidetectd-debuginfo
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-ipmiseld
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
freeipmi-ipmiseld-debuginfo
Amazon Linux 2023
0:1.6.19-1.amzn2023
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
freeipmi
Azure Linux 3.0
0:1.6.19-1.azl3
fixed
Common Weakness Enumeration
References
https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz
https://www.gnu.org/software/freeipmi/
https://www.openwall.com/lists/oss-security/2026/08/28/5