Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-85509: FreeIPMI can be hijacked by malformed hardware response
CVE-2026-85509 · published 1 month ago
Summary
The freeipmi library used in several Linux distributions can overflow its memory when a server's management controller (BMC) sends more data than expected. This could let an attacker who controls the BMC run unwanted code or crash the system. Upgrade freeipmi to version 1.6.19 or newer to fix the issue.
What to do
- Update debian freeipmi to version 1.6.19-1.
- Update canonical freeipmi to version 1.1.5-3ubuntu3.3+esm2.
- Update canonical freeipmi to version 1.4.11-1.1ubuntu4.1~0.16.04.1~esm2.
- Update canonical freeipmi to version 1.4.11-1.1ubuntu4.1+esm2.
- Update canonical freeipmi to version 1.6.4-3ubuntu1.1+esm2.
- Update canonical freeipmi to version 1.6.9-2ubuntu0.22.04.4.
- Update canonical freeipmi to version 1.6.13-3ubuntu0.2.
- Update canonical freeipmi to version 1.6.16-1ubuntu0.2.
- Update bellsoft freeipmi to version 1.6.19-r0.
- Update freeipmi freeipmi to version 1.6.19 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | freeipmi | freeipmi | < 1.6.19 |
| Ubuntu:Pro:14.04:LTS | canonical | freeipmi |
< 1.1.5-3ubuntu3.3+esm2 Fix: upgrade to 1.1.5-3ubuntu3.3+esm2
|
| Debian:12 | debian | freeipmi | All versions |
| Debian:14 | debian | freeipmi |
< 1.6.19-1 Fix: upgrade to 1.6.19-1
|
| Ubuntu:Pro:16.04:LTS | canonical | freeipmi |
< 1.4.11-1.1ubuntu4.1~0.16.04.1~esm2 Fix: upgrade to 1.4.11-1.1ubuntu4.1~0.16.04.1~esm2
|
| Ubuntu:Pro:18.04:LTS | canonical | freeipmi |
< 1.4.11-1.1ubuntu4.1+esm2 Fix: upgrade to 1.4.11-1.1ubuntu4.1+esm2
|
| Ubuntu:Pro:20.04:LTS | canonical | freeipmi |
< 1.6.4-3ubuntu1.1+esm2 Fix: upgrade to 1.6.4-3ubuntu1.1+esm2
|
| Ubuntu:22.04:LTS | canonical | freeipmi |
< 1.6.9-2ubuntu0.22.04.4 Fix: upgrade to 1.6.9-2ubuntu0.22.04.4
|
| Ubuntu:24.04:LTS | canonical | freeipmi |
< 1.6.13-3ubuntu0.2 Fix: upgrade to 1.6.13-3ubuntu0.2
|
| Ubuntu:26.04:LTS | canonical | freeipmi |
< 1.6.16-1ubuntu0.2 Fix: upgrade to 1.6.16-1ubuntu0.2
|
| Alpaquita:25 | bellsoft | freeipmi |
>= 1.6.15-r0, < 1.6.19-r0 Fix: upgrade to 1.6.19-r0
|
| Alpaquita:stream | bellsoft | freeipmi |
>= 1.6.10-r0, < 1.6.19-r0 Fix: upgrade to 1.6.19-r0
|
Original advisory text
BELL-CVE-2026-85509
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
References
- https://ubuntu.com/security/CVE-2026-85509 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-85509 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-85509 Vendor Advisory
- https://www.openwall.com/lists/oss-security/2026/08/28/5 Third Party Advisory
- https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz Third Party Advisory
- https://www.gnu.org/software/freeipmi/ Third Party Advisory
- https://ubuntu.com/security/notices/USN-8843-1 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-85509 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published8 Sep 2026
Updated4 Nov 2026
First seen4 Sep 2026
Sources
CVE-2026-85509 · NVD
CVE-2026-85509 · MITRE
UBUNTU-CVE-2026-85509 · OSV
DEBIAN-CVE-2026-85509 · OSV
BELL-CVE-2026-85509 · OSV
Track software like this
Free during beta