CVE-2026-85506: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-85506 is a stack-based buffer overflow vulnerability in the ipmi-oem utility of FreeIPMI, specifically in the _get_dell_system_info_idrac_info function within ipmi-oem/ipmi-oem-dell.c, triggered via the idrac-info subcommand of dell get-system-info. It affects all FreeIPMI versions before 1.6.19 and was publicly disclosed on September 4, 2026, following the release of FreeIPMI 1.6.19 on August 27, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network-exploitable, unauthenticated, no-user-interaction attack profile (Red Hat Advisory, GitHub Advisory).

The root cause is a stack-based buffer overflow (CWE-121) in the _get_dell_system_info_idrac_info function in ipmi-oem/ipmi-oem-dell.c, where insufficient bounds checking allows attacker-controlled data to overwrite stack memory. An unauthenticated remote attacker can exploit this by sending a crafted IPMI response to the ipmi-oem dell get-system-info idrac-info subcommand, causing the overflow when the tool processes the malicious payload. The FreeIPMI 1.6.19 release notes confirm that multiple potential stack overflows were identified via code analysis in the dell get-system-info command family, including idrac-info, cmc-info, and cmc-ipv6-info subcommands (Openwall oss-security, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the ipmi-oem process, resulting in high confidentiality, integrity, and availability impact on the affected system. Because IPMI management interfaces often have broad access to server hardware and out-of-band management functions, compromise could enable persistent access, lateral movement within server management networks, and full hardware-level control of affected systems (Red Hat Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (GitHub Advisory, Red Hat Advisory).

The primary remediation is to upgrade FreeIPMI to version 1.6.19 or later, which includes fixes for the identified stack overflows in the dell get-system-info command family (Openwall oss-security). The patched release is available at https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz. As a compensating control, restrict network access to IPMI management interfaces using firewall rules or network segmentation, limiting exposure to trusted management networks only (Red Hat Advisory).

The vulnerability was forwarded to the oss-security mailing list by Chad Dougherty of Carnegie Mellon University on August 28, 2026, drawing attention from the open-source security community. Red Hat opened a security bug (BZ#2528398) and classified it as high severity. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed (Openwall oss-security, Red Hat Bugzilla).