CVE-2026-65200: openUBMC Buffer Overflow Vulnerability

CVE-2026-65200 Overview

CVE-2026-65200 is an integer underflow vulnerability [CWE-191] in the openUBMC device-management process. Three response parsers in the shared PLDM-over-MCTP and NCSI-over-MCTP transport libraries subtract a fixed header or reserved-field size from a device-supplied response length. None of the parsers perform a lower-bound check before the subtraction. An undersized response causes the unsigned length difference to wrap to a very large value. The parser then reads far past the response buffer. The flaw sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so any PLDM endpoint or Huawei NIC on the internal management bus can reach the vulnerable code.

Critical Impact
A malicious device on the internal management bus can trigger an out-of-bounds read in the openUBMC device-management process, resulting in information disclosure and limited availability loss on the baseboard management controller.

Affected Products

openUBMC device-management process (base PLDM control class)
openUBMC shared PLDM-over-MCTP transport library
openUBMC Huawei NCSI-over-MCTP driver

Discovery Timeline

2026-10-13 - CVE-2026-65200 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-65200

Vulnerability Analysis

The vulnerability resides in three response parsers that handle PLDM (Platform Level Data Model) and NCSI (Network Controller Sideband Interface) messages tunneled over MCTP (Management Component Transport Protocol). Each parser receives a response length value from a device on the internal management bus. The parser then subtracts a fixed header or reserved-field size from that value to compute a payload length.

Because the length field is treated as an unsigned integer, a value smaller than the header size wraps around to a very large positive number. The parser uses that wrapped length to read from the response buffer, moving far past the allocated bounds. The resulting out-of-bounds read can disclose adjacent memory contents and may terminate the device-management process.

The affected code is reachable from any PLDM endpoint and from Huawei NICs attached to the management bus. A separately tracked wangxun vendor parser is not in scope for this CVE.

Root Cause

The parsers compute payload_len = response_len - header_size without verifying that response_len >= header_size. Unsigned integer semantics turn an undersized response into a maximum-range length. The subsequent buffer read uses the wrapped length as a copy or iteration bound.

Attack Vector

Exploitation requires physical adjacency on the internal management bus of a system running openUBMC. An attacker must introduce or compromise a PLDM endpoint or a Huawei NIC that returns malformed, undersized responses to parser requests originating from the BMC. The vulnerability is not reachable over the network.

The vulnerability mechanism is described in prose; no verified exploit code is published. See the RunZero Security Advisory CVE-2026-65200 for the vendor-tracked analysis.

Detection Methods for CVE-2026-65200

Indicators of Compromise

Unexpected crashes, restarts, or memory faults in the openUBMC device-management process
Malformed PLDM or NCSI response frames on the MCTP bus with length fields smaller than their declared header size
Appearance of unexpected or unauthorized PLDM endpoints or NICs enumerated on the internal management bus

Detection Strategies

Review BMC process logs for abnormal termination or signal faults tied to PLDM or NCSI response handling
Inspect MCTP traffic captures for responses whose response_len field is below the fixed header size parsed by the PLDM control class or Huawei NCSI driver
Correlate hardware inventory changes against expected device lists to flag introduction of untrusted on-bus devices

Monitoring Recommendations

Enable verbose logging on the openUBMC device-management process and forward records to a central log platform for anomaly review
Alert on repeated parser errors or buffer-related faults from BMC subsystems
Monitor physical access to server chassis and ports exposing the management bus

How to Mitigate CVE-2026-65200

Immediate Actions Required

Inventory systems running openUBMC and identify devices exposing PLDM endpoints or Huawei NICs on the internal management bus
Restrict physical access to systems where the management bus could be reached by untrusted hardware
Validate that only known, trusted on-bus devices are enumerated by the BMC

Patch Information

No fixed version information is available in the published advisory data. Consult the RunZero Security Advisory CVE-2026-65200 and openUBMC project channels for patch availability. Apply vendor-supplied firmware or BMC updates once released.

Workarounds

Enforce supply chain controls to prevent introduction of malicious PLDM or NCSI devices into managed hardware
Disable or physically block unused MCTP endpoints where supported by platform firmware
Segregate systems that must accept third-party on-bus devices from systems holding sensitive workloads

bash

# Configuration example
# No vendor-supplied mitigation configuration is published for CVE-2026-65200.
# Refer to the RunZero advisory and openUBMC project for updates:
# https://www.runzero.com/advisories/huawei-malicious-device-integer-underflow-cve-2026-65200