5 vulnerabilities across 2 products scored HIGH or above on September 04, 2026.

  • 🟠 HIGH: 5

🟠 [HIGH] freeipmi/freeipmi

4 CVEs | CVSS 3.1: 9.8 | AAS 10.9

  • cpe:2.3:a:freeipmi:freeipmi:*:*:*:*:*:*:*:* (< 1.6.19)

FreeIPMI, the open-source IPMI management suite used for out-of-band server monitoring and hardware management, is affected by four vulnerabilities including at least one critical stack-based buffer overflow (CVSS 9.8) in the SEL parsing library. A remote attacker could exploit malformed Fujitsu IRMC SEL responses to trigger memory corruption, potentially achieving code execution on systems running vulnerable versions prior to 1.6.19.

Organizations using FreeIPMI for bare-metal server management, particularly in environments with Fujitsu iRMC baseboard management controllers, should treat this as high priority. Upgrade to FreeIPMI 1.6.19 or later immediately. Given that IPMI tooling often runs with elevated privileges on management networks, exploitation could provide deep infrastructure access.

Vendor Advisory

🟠 [HIGH] gnu/freeipmi

1 CVE | CVSS 3.1: 9.8 | AAS 10.1

  • cpe:2.3:a:gnu:freeipmi:*:*:*:*:*:*:*:* (< 1.6.19)

GNU FreeIPMI versions prior to 1.6.19 contain a critical stack-based buffer overflow (CVSS 9.8) in the FRU data parsing library, triggered when a baseboard management controller returns more bytes than requested during hardware inventory reads. A malicious or compromised BMC on the management network could exploit this to achieve code execution on the host running FreeIPMI, which typically operates with root privileges.

Infrastructure and data center teams using FreeIPMI for server hardware monitoring should upgrade to version 1.6.19 immediately. This is especially urgent in environments where IPMI management traffic is not fully isolated, as exploitation requires only network access to a BMC that can deliver a crafted FRU response.

Vendor Advisory