CVE-2026-50031 Memory corruption in FreeIPMI
Buffer overflows in FreeIPMI ipmi-oem allow attackers to execute arbitrary code via crafted response messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50031?
CVE-2026-50031 is a high-severity memory corruption vulnerability in FreeIPMI, published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands "ipmi-oem dell get-active-directory-config" and "ipmi-oem fujitsu get-sel-entry-long-text" were found to have exploitable buffer overflows on response messages.
Weakness: CWE-121
Which versions are affected by CVE-2026-50031?
Linux distribution packages (40)
freeipmi AlmaLinux:10 | All versions | 1.6.18-1.el10_2 |
freeipmi-bmc-watchdog AlmaLinux:10 | All versions | 1.6.18-1.el10_2 |
freeipmi-devel AlmaLinux:10 | All versions | 1.6.18-1.el10_2 |
freeipmi-ipmidetectd AlmaLinux:10 | All versions | 1.6.18-1.el10_2 |
freeipmi-ipmiseld AlmaLinux:10 | All versions | 1.6.18-1.el10_2 |
freeipmi AlmaLinux:8 | All versions | 1.6.18-1.el8_10 |
freeipmi-bmc-watchdog AlmaLinux:8 | All versions | 1.6.18-1.el8_10 |
freeipmi-devel AlmaLinux:8 | All versions | 1.6.18-1.el8_10 |
freeipmi-ipmidetectd AlmaLinux:8 | All versions | 1.6.18-1.el8_10 |
freeipmi-ipmiseld AlmaLinux:8 | All versions | 1.6.18-1.el8_10 |
freeipmi AlmaLinux:9 | All versions | 1.6.18-1.el9_8 |
freeipmi-bmc-watchdog AlmaLinux:9 | All versions | 1.6.18-1.el9_8 |
freeipmi-devel AlmaLinux:9 | All versions | 1.6.18-1.el9_8 |
freeipmi-ipmidetectd AlmaLinux:9 | All versions | 1.6.18-1.el9_8 |
freeipmi-ipmiseld AlmaLinux:9 | All versions | 1.6.18-1.el9_8 |
freeipmi Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-bmc-watchdog Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-bmc-watchdog-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-devel Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-ipmidetectd Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-ipmidetectd-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-ipmiseld Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi-ipmiseld-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.6.18-1.el10_2 |
freeipmi Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-bmc-watchdog Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-bmc-watchdog-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-ipmidetectd Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-ipmidetectd-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-ipmiseld Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-ipmiseld-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.6.18-1.el8_10 |
freeipmi-bmc-watchdog-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.6.18-1.el8_10 |
freeipmi-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.6.18-1.el8_10 |
freeipmi-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:1.6.18-1.el8_10 |
freeipmi-devel Red Hat:enterprise_linux:8::crb | All versions | 0:1.6.18-1.el8_10 |
freeipmi-ipmidetectd-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.6.18-1.el8_10 |
freeipmi-ipmiseld-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.6.18-1.el8_10 |
How do I fix CVE-2026-50031?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-50031 being exploited?
There is no known exploitation of CVE-2026-50031 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:36210, ALSA-2026:36211, ALSA-2026:36307, AZL-89328, BELL-CVE-2026-50031, CLSA-2026-1783597433 and 22 more.