Moderate Vulnerability in freeipmi Package: Buffer Overflow Risk
Summary
ALSA-2026:19208: Moderate: freeipmi security update. Affects freeipmi versions < 1.6.17-1.el9_8. Fixed in 1.6.17-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The freeipmi package provides Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. It is widely used for managing and monitoring hardware components in servers and other systems. The package includes various components such as freeipmi-bmc-watchdog, freeipmi-devel, freeipmi-ipmidetectd, and freeipmi-ipmiseld, all of which are essential for effective system management.
Vulnerability Detail
The vulnerability identified as CVE-2026-33554 involves buffer overflows occurring on response messages via the ipmi-oem command. This flaw can potentially allow an attacker to execute arbitrary code or crash the application, leading to unauthorized access or denial of service. The issue arises from improper handling of input data, which can be exploited if the software processes unexpected or maliciously crafted messages.
How To Fix
Minimum fixed version
1.6.17-1.el9_8
This is the first release that contains the fix.
sudo dnf update freeipmiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the affected services or disable the ipmi-oem command until the package is updated. This can help reduce the risk of exploitation while waiting for the official patch.
Conclusion
The freeipmi package has a moderate vulnerability (CVE-2026-33554) that can lead to serious security risks if not addressed. Users are advised to update to the latest patched version to mitigate these risks. For ongoing monitoring of vulnerabilities, consider using Vulert, which can help you stay informed about potential threats without requiring extensive setup.
See every vulnerability recorded for freeipmi →
FAQ
CVE-2026-33554 is a vulnerability in the freeipmi package that involves buffer overflows on response messages via the ipmi-oem command.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability could lead to arbitrary code execution or denial of service, compromising system integrity and availability.
Yes, the patched version of the freeipmi package is 1.6.17-1.el9_8. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, consider limiting access to the affected services or disabling the ipmi-oem command as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for freeipmi.
