CVE-2026-33554 Memory corruption in FreeIPMI
Buffer overflows in FreeIPMI ipmi-oem allow attackers to execute arbitrary code via crafted response messages from supported hardware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33554?
CVE-2026-33554 is a high-severity memory corruption vulnerability in FreeIPMI, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ipmi-oem in FreeIPMI before 1.6.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers," and "ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers."
Weakness: CWE-121
Which versions are affected by CVE-2026-33554?
Linux distribution packages (40)
freeipmi AlmaLinux:10 | All versions | 1.6.17-1.el10_1 |
freeipmi AlmaLinux:10 | All versions | 1.6.17-1.el10_2 |
freeipmi-bmc-watchdog AlmaLinux:10 | All versions | 1.6.17-1.el10_1 |
freeipmi-bmc-watchdog AlmaLinux:10 | All versions | 1.6.17-1.el10_2 |
freeipmi-devel AlmaLinux:10 | All versions | 1.6.17-1.el10_1 |
freeipmi-devel AlmaLinux:10 | All versions | 1.6.17-1.el10_2 |
freeipmi-ipmidetectd AlmaLinux:10 | All versions | 1.6.17-1.el10_1 |
freeipmi-ipmidetectd AlmaLinux:10 | All versions | 1.6.17-1.el10_2 |
freeipmi-ipmiseld AlmaLinux:10 | All versions | 1.6.17-1.el10_1 |
freeipmi-ipmiseld AlmaLinux:10 | All versions | 1.6.17-1.el10_2 |
freeipmi AlmaLinux:8 | All versions | 1.6.17-1.el8_10 |
freeipmi-bmc-watchdog AlmaLinux:8 | All versions | 1.6.17-1.el8_10 |
freeipmi-devel AlmaLinux:8 | All versions | 1.6.17-1.el8_10 |
freeipmi-ipmidetectd AlmaLinux:8 | All versions | 1.6.17-1.el8_10 |
freeipmi-ipmiseld AlmaLinux:8 | All versions | 1.6.17-1.el8_10 |
freeipmi AlmaLinux:9 | All versions | 1.6.17-1.el9_7 |
freeipmi AlmaLinux:9 | All versions | 1.6.17-1.el9_8 |
freeipmi-bmc-watchdog AlmaLinux:9 | All versions | 1.6.17-1.el9_7 |
freeipmi-bmc-watchdog AlmaLinux:9 | All versions | 1.6.17-1.el9_8 |
freeipmi-devel AlmaLinux:9 | All versions | 1.6.17-1.el9_7 |
freeipmi-devel AlmaLinux:9 | All versions | 1.6.17-1.el9_8 |
freeipmi-ipmidetectd AlmaLinux:9 | All versions | 1.6.17-1.el9_7 |
freeipmi-ipmidetectd AlmaLinux:9 | All versions | 1.6.17-1.el9_8 |
freeipmi-ipmiseld AlmaLinux:9 | All versions | 1.6.17-1.el9_7 |
freeipmi-ipmiseld AlmaLinux:9 | All versions | 1.6.17-1.el9_8 |
freeipmi Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-bmc-watchdog Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-bmc-watchdog-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-devel Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-ipmidetectd Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-ipmidetectd-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-ipmiseld Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi-ipmiseld-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:1.6.17-1.el10_1 |
freeipmi Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.17-1.el10_2 |
freeipmi-bmc-watchdog Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.17-1.el10_2 |
freeipmi-bmc-watchdog-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.17-1.el10_2 |
freeipmi-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.17-1.el10_2 |
freeipmi-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.17-1.el10_2 |
How do I fix CVE-2026-33554?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-33554 being exploited?
There is no known exploitation of CVE-2026-33554 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:13515, ALSA-2026:14819, ALSA-2026:19053, ALSA-2026:19208, ALSA-2026:20579, AZL-81423 and 30 more.