CVE-2026-50031: FreeIPMI Buffer Overflow Vulnerability

CVE-2026-50031 Overview

CVE-2026-50031 is a stack-based buffer overflow [CWE-121] in the ipmi-oem client utility of FreeIPMI before version 1.6.18. The flaw resides in the handling of IPMI response messages for two vendor-specific subcommands: ipmi-oem dell get-active-directory-config and ipmi-oem fujitsu get-sel-entry-long-text. A malicious or compromised Baseboard Management Controller (BMC) returning crafted response payloads can overflow client-side buffers when an administrator runs the affected commands. The Intelligent Platform Management Interface (IPMI) is widely deployed for out-of-band server management, making FreeIPMI a common operator tool in data center environments.

Critical Impact
A remote IPMI server can corrupt stack memory in the FreeIPMI client, causing process crash and potential availability loss on management workstations.

Affected Products

FreeIPMI versions prior to 1.6.18
ipmi-oem utility with Dell get-active-directory-config subcommand
ipmi-oem utility with Fujitsu get-sel-entry-long-text subcommand

Discovery Timeline

2026-06-03 - CVE-2026-50031 published to the National Vulnerability Database
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-50031

Vulnerability Analysis

The ipmi-oem command implements IPMI OEM extensions used to query vendor-specific platform data from BMCs. Two subcommands fail to validate the length of fields returned in IPMI response messages before copying them into fixed-size stack buffers. When a server sends a response with oversized fields, the client writes past the buffer boundary, corrupting adjacent stack memory including saved return addresses.

The issue affects the client side of the IPMI exchange. An attacker controlling or impersonating an IPMI-responsive BMC can deliver the malformed response when a legitimate administrator invokes the vulnerable subcommand. Impact is limited to availability based on the CVSS vector, with no confidentiality or integrity exposure asserted by the published metrics.

Root Cause

The root cause is missing or insufficient bounds checking on response message fields parsed by the Dell Active Directory configuration handler and the Fujitsu SEL long-text entry handler. The parsers trust length values or string content supplied by the responding IPMI device and copy data into stack buffers sized for expected, well-formed responses. This is a classic stack buffer overflow pattern categorized as [CWE-121].

Attack Vector

Exploitation requires a user to run ipmi-oem against a malicious or compromised target. The attack vector is network-based because IPMI traffic typically traverses a management LAN between the operator host and the BMC. No authentication or user interaction beyond invoking the affected subcommand is required for the malicious response to reach the vulnerable parser. The vulnerability manifests in the response-handling routines for the two named subcommands; see Savannah Bug Report #68363 and Savannah Bug Report #68364 for upstream analysis.

Detection Methods for CVE-2026-50031

Indicators of Compromise

Unexpected crashes or segmentation faults of the ipmi-oem process on management hosts
Core dumps from ipmi-oem referencing stack corruption in Dell or Fujitsu OEM handlers
IPMI response packets with abnormally long fields directed at hosts running FreeIPMI
Outbound IPMI sessions from operator workstations to unexpected or untrusted BMC endpoints

Detection Strategies

Inventory hosts running FreeIPMI and identify versions earlier than 1.6.18 through package management queries
Monitor process telemetry for abnormal termination of ipmi-oem invocations and correlate with concurrent IPMI traffic
Inspect IPMI RMCP+ traffic at the management network boundary for malformed OEM response payloads

Monitoring Recommendations

Log all execution of ipmi-oem commands including the target BMC address and subcommand
Alert on ipmi-oem process crashes followed by retries or lateral activity from the same host
Audit which BMC endpoints are reachable from operator workstations and flag connections to unmanaged devices

How to Mitigate CVE-2026-50031

Immediate Actions Required

Upgrade FreeIPMI to version 1.6.18 or later on every host where ipmi-oem is installed
Restrict use of the dell get-active-directory-config and fujitsu get-sel-entry-long-text subcommands until patching is complete
Limit IPMI client operations to trusted, authenticated BMC endpoints on isolated management networks

Patch Information

The FreeIPMI maintainers fixed the buffer overflows in version 1.6.18. The release announcement is available on the GNU Mailing List Archive. Distribution packagers should rebuild and ship the updated release; operators should verify the installed version with ipmi-oem --version after upgrading.

Workarounds

Avoid running the two affected subcommands against any BMC that is not fully trusted and known-good
Segment IPMI management traffic onto a dedicated VLAN with strict access controls to prevent rogue devices from responding
Remove or restrict execute permissions on ipmi-oem for users who do not require OEM functionality

bash

# Verify installed FreeIPMI version and upgrade if below 1.6.18
ipmi-oem --version
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade freeipmi
# RHEL/Fedora
sudo dnf upgrade freeipmi