Executive Summary
CVE-2026-85504 is a critical stack-based buffer overflow in FreeIPMI, the widely used open-source library and toolset for managing Intelligent Platform Management Interface (IPMI) and Baseboard Management Controller (BMC) hardware. The bug lives in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c, and is triggered by a malformed Fujitsu System Event Log (SEL) long-text response.
CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The issue affects all FreeIPMI versions before 1.6.19, which was released with a fix. MITRE assigned the CVE, reserved and published on 2026-09-04.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-85504 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-121 — Stack-Based Buffer Overflow |
| Component | libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c |
| Trigger | Malformed Fujitsu SEL long-text response from a BMC |
| Assigner | MITRE |
Technical Details
FreeIPMI parses SEL entries returned by a system's BMC to present human-readable event log text, including vendor-specific (OEM) formats such as Fujitsu's iRMC long-text SEL entries. The parsing routine _ipmi_sel_oem_fujitsu_get_sel_entry_long_text writes attacker- or device-controlled response data into a fixed-size stack buffer without adequate bounds checking. A malicious or compromised BMC — or an attacker capable of spoofing IPMI responses on the management network — can send a crafted, oversized long-text SEL entry to overflow the buffer, corrupting the stack.
This CVE was disclosed as part of a batch of six related FreeIPMI vulnerabilities, several sharing the same root cause across different OEM parsing paths:
| CVE | Description |
|---|---|
| CVE-2026-85504 (this advisory) | Stack overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text (libfreeipmi) |
| CVE-2026-85505 | Stack buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text when a BMC returns a short response |
| CVE-2026-85506 | Stack overflow in _get_dell_system_info_idrac_info (ipmi-oem dell get-system-info idrac-info) |
| CVE-2026-85507 | Stack overflow in _output_dell_system_info_cmc_info (ipmi-oem dell get-system-info cmc-info) |
All were addressed together in the FreeIPMI 1.6.19 release.
Impact of Successful Exploitation
| Impact | Description |
|---|---|
| Memory Corruption | Stack overflow can crash the FreeIPMI process (denial of service) |
| Potential Code Execution | Depending on stack layout and mitigations, overflow may be leveraged for arbitrary code execution |
| Management Infrastructure Risk | FreeIPMI underpins BMC/IPMI tooling used across server fleets, HPC clusters, and data center management stacks |
| Trust Boundary Violation | A compromised or rogue BMC can attack the management host that queries it |
Immediate Remediation
- Upgrade to FreeIPMI 1.6.19 or later — available from ftp.gnu.org/gnu/freeipmi.
- Audit BMC trust boundaries — restrict IPMI/BMC management traffic to dedicated, isolated management networks.
- Verify distro packages — check whether your Linux distribution's
freeipmi/libfreeipmipackages have shipped a backported fix, and update accordingly. - Restrict who can query BMCs — limit which hosts are permitted to run FreeIPMI tools against a given BMC.
Detection Indicators
| Indicator | Description |
|---|---|
| FreeIPMI tool crashes while parsing SEL entries from Fujitsu hardware | Possible exploitation attempt or triggering bug |
| Unexpected or oversized SEL long-text entries in BMC logs | Sign of a crafted malicious response |
Core dumps from ipmi-sel or related FreeIPMI utilities | Warrants investigation for exploitation |