CVE-2026-50031: ipmi-oem in FreeIPMI before 1

Synopsis

Stack-based buffer overflow in the ipmi-oem client command of FreeIPMI before version 1.6.18. The vulnerability is reachable over the network without authentication, triggered when ipmi-oem processes a crafted IPMI response message from a malicious or compromised server. Successful exploitation causes a denial of service by crashing the affected client process. A patched-image rebuild at version 1.6.18 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The ipmi-oem client must connect to a reachable IPMI server over the network; a malicious or compromised server endpoint delivers the crafted response that triggers the overflow.

• AuthenticationNot required

  No authentication is required on the attacker's side; the vulnerability is triggered by a server response, so any server the client contacts can serve the malicious payload.

• Victim interactionNot required

  No victim interaction beyond normal use is required; the overflow fires when ipmi-oem processes the server's response during a routine OEM command call.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors beyond the client connecting to a controlled server.

Blast Radius

• Crashes the ipmi-oem client process, interrupting any in-progress OEM management operation such as Active Directory config retrieval or SEL log access.
• Repeated exploitation causes persistent denial of service for administrators relying on ipmi-oem for hardware management tasks on Dell or Fujitsu systems.
• No confidentiality or integrity impact is indicated; the attacker cannot read data or modify system state through this vulnerability alone.