Moderate Vulnerability in freeipmi: Buffer Overflow in Response Messages
Summary
RLSA-2026:13515: Moderate: freeipmi security update. Affects freeipmi versions < 0:1.6.17-1.el10_1. Fixed in 0:1.6.17-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The freeipmi package provides Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. It is widely used for managing and monitoring hardware components in servers and other systems, allowing administrators to perform tasks such as power cycling and hardware monitoring remotely. The package is crucial for maintaining system health and ensuring operational efficiency.
Vulnerability Detail
The vulnerability identified as CVE-2026-33554 is a buffer overflow issue that occurs in the freeipmi package when handling response messages via the ipmi-oem command. This flaw can be exploited by an attacker to execute arbitrary code, potentially leading to unauthorized access or control over the affected system. The severity of this vulnerability is rated with a CVSS score of 8.8, indicating a high risk to systems that utilize this package.
How To Fix
Minimum fixed version
0:1.6.17-1.el10_1
This is the first release that contains the fix.
sudo dnf update freeipmiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling the ipmi-oem command if it is not essential for their operations. This can help mitigate the risk until the package is updated.
Conclusion
The freeipmi package has a moderate vulnerability (CVE-2026-33554) that poses a significant risk due to buffer overflow issues in response messages. Users are advised to update to the latest patched version to mitigate this risk effectively. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for freeipmi →
FAQ
CVE-2026-33554 is a vulnerability in the freeipmi package that allows for buffer overflow attacks via response messages, potentially leading to arbitrary code execution.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
If an immediate update is not possible, consider disabling the ipmi-oem command as a temporary workaround to reduce exposure to the vulnerability.
For detailed information, refer to the CVE page associated with CVE-2026-33554, which provides insights into the impact and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for freeipmi.
