Read the docs
TI-2026-25945 Aliases CVE-2026-33554GHSA-382w-q5p9-3f2h

Stack-based buffer overflow in FreeIPMI

Priority LOW 39CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 20 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-121 and the CVSS impact.

Summary

ipmi-oem in FreeIPMI before 1.6.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers," and "ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Partial FreeIPMI (FreeIPMI): 1.6.17Red Hat: 13 advisoriesRed Hat: 20 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FreeIPMIFreeIPMI0.7.12 to before 1.6.171.6.17Patch availableCNA
  • FreeIPMI VendorFreeIPMI Affected 0.7.12 to before 1.6.17 Fixed in 1.6.17 Patch available CNA

Remediation

  • Fix · CNA FreeIPMI (FreeIPMI) Fixed in 1.6.17

Red Hat 13 advisories

  • RHSA-2026:50769 Released 2026-08-05 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) freeipmi-1.6.8-1.el8_8.1, freeipmi-bmc-watchdog-1.6.8-1.el8_8.1, freeipmi-ipmidetectd-1.6.8-1.el8_8.1 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) freeipmi-1.6.8-1.el8_8.1, freeipmi-bmc-watchdog-1.6.8-1.el8_8.1, freeipmi-ipmidetectd-1.6.8-1.el8_8.1 +1
  • RHSA-2026:50772 Released 2026-08-05 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) freeipmi-1.6.8-1.el8_6.1, freeipmi-bmc-watchdog-1.6.8-1.el8_6.1, freeipmi-ipmidetectd-1.6.8-1.el8_6.1 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) freeipmi-1.6.8-1.el8_6.1, freeipmi-bmc-watchdog-1.6.8-1.el8_6.1, freeipmi-ipmidetectd-1.6.8-1.el8_6.1 +1
  • RHSA-2026:50729 Released 2026-08-05 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) freeipmi-1.6.6-1.el8_4.1, freeipmi-bmc-watchdog-1.6.6-1.el8_4.1, freeipmi-ipmidetectd-1.6.6-1.el8_4.1 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) freeipmi-1.6.6-1.el8_4.1, freeipmi-bmc-watchdog-1.6.6-1.el8_4.1, freeipmi-ipmidetectd-1.6.6-1.el8_4.1 +1
Show 10 more Red Hat advisories
  • RHSA-2026:48826 Released 2026-07-31 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) freeipmi-1.5.7-3.el7_9.1, freeipmi-1.5.7-3.el7_9.1.ppc, freeipmi-bmc-watchdog-1.5.7-3.el7_9.1 +1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) freeipmi-devel-1.5.7-3.el7_9.1, freeipmi-devel-1.5.7-3.el7_9.1.ppc, freeipmi-ipmiseld-1.5.7-3.el7_9.1
  • RHSA-2026:39006 Released 2026-07-13 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) freeipmi-devel-1.6.14-2.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) freeipmi-1.6.14-2.el9_6.1, freeipmi-bmc-watchdog-1.6.14-2.el9_6.1, freeipmi-ipmidetectd-1.6.14-2.el9_6.1 +1
  • RHSA-2026:39008 Released 2026-07-13 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) freeipmi-1.6.14-2.el9_4.1, freeipmi-bmc-watchdog-1.6.14-2.el9_4.1, freeipmi-ipmidetectd-1.6.14-2.el9_4.1 +1
  • RHSA-2026:39010 Released 2026-07-13 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) freeipmi-1.6.14-2.el9_2.1, freeipmi-bmc-watchdog-1.6.14-2.el9_2.1, freeipmi-ipmidetectd-1.6.14-2.el9_2.1 +1
  • RHSA-2026:39007 Released 2026-07-13 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) freeipmi-1.6.14-4.el10_0.1, freeipmi-bmc-watchdog-1.6.14-4.el10_0.1, freeipmi-ipmidetectd-1.6.14-4.el10_0.1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) freeipmi-devel-1.6.14-4.el10_0.1
  • RHSA-2026:20579 Released 2026-05-26 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux BaseOS (v. 8) freeipmi-1.6.17-1.el8_10, freeipmi-bmc-watchdog-1.6.17-1.el8_10, freeipmi-ipmidetectd-1.6.17-1.el8_10 +1
    • Red Hat Enterprise Linux CRB (v. 8) freeipmi-devel-1.6.17-1.el8_10
  • RHSA-2026:19208 Released 2026-05-19 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux AppStream (v. 9) freeipmi-1.6.17-1.el9_8, freeipmi-bmc-watchdog-1.6.17-1.el9_8, freeipmi-ipmidetectd-1.6.17-1.el9_8 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) freeipmi-devel-1.6.17-1.el9_8
  • RHSA-2026:19053 Released 2026-05-19 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux AppStream (v. 10) freeipmi-1.6.17-1.el10_2, freeipmi-bmc-watchdog-1.6.17-1.el10_2, freeipmi-ipmidetectd-1.6.17-1.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) freeipmi-devel-1.6.17-1.el10_2
  • RHSA-2026:14819 Released 2026-05-07 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux AppStream (v. 9) freeipmi-1.6.17-1.el9_7, freeipmi-bmc-watchdog-1.6.17-1.el9_7, freeipmi-ipmidetectd-1.6.17-1.el9_7 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) freeipmi-devel-1.6.17-1.el9_7
  • RHSA-2026:13515 Released 2026-05-04 · Red Hat rating Moderate
    freeipmi security update
    • Red Hat Enterprise Linux AppStream (v. 10) freeipmi-1.6.17-1.el10_1, freeipmi-bmc-watchdog-1.6.17-1.el10_1, freeipmi-ipmidetectd-1.6.17-1.el10_1 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) freeipmi-devel-1.6.17-1.el10_1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:39006
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:13515, RHSA-2026:19053
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:14819, RHSA-2026:19208
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:39010
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:39008
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:39007
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:39006
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:20579
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:50729
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:50772
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:50769
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:50729
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:50772
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:50769
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:20579
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:13515, RHSA-2026:19053
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:14819, RHSA-2026:19208
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:39007
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:48826
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:48826

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33554
  2. 2026-10-03 Alias added: GHSA-382w-q5p9-3f2h

References

Other 4

  • TI-2026-58671 Stack-based buffer overflow in FreeIPMI CVSS 3.1CRITICAL 9.8
  • TI-2026-58670 Stack-based buffer overflow in FreeIPMI CVSS 3.1CRITICAL 9.8
  • TI-2026-58669 Stack-based buffer overflow in FreeIPMI CVSS 3.1CRITICAL 9.8
  • TI-2026-58668 Stack-based buffer overflow in FreeIPMI CVSS 3.1CRITICAL 9.8
  • TI-2026-58666 Stack-based buffer overflow in FreeIPMI CVSS 3.1CRITICAL 9.8
  • TI-2026-58667 Out-of-bounds read in FreeIPMI CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences