# CVE-2026-33554: GNU FreeIPMI buffer overflows in ipmi-oem response parsing

Source: https://junglewise.ai/threats/cve-2026-33554-gnu-freeipmi-buffer-overflows-in-ipmi-oem-response-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-24. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-33554 · Severity: high · CVSS 7.5 · Published 2026-03-24

FreeIPMI is a suite of tools used by system administrators to monitor hardware health (like CPU temperature) and manage remote power for servers. A security flaw in the 'ipmi-oem' tool could allow a malicious or compromised server to crash the management software when it requests system information. This could disrupt server monitoring operations and potentially allow an attacker to execute unauthorized code on the administrator's machine.

Vendors: [GNU Project](https://junglewise.ai/threats/vendors/gnu-project).

## Quick answers

**Is CVE-2026-33554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33554 being exploited in the wild.

**How severe is CVE-2026-33554?** High severity, with a CVSS score of 7.5, published 24 March 2026.

**Which products and versions are affected?** GNU Project FreeIPMI before 1.6.17.

**Is there a fix for CVE-2026-33554?** A patch was published on 2026-03-23: Fixed in FreeIPMI version 1.6.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33554 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33554?** Check whether you run GNU Project FreeIPMI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple stack-based buffer overflows (CWE-121) exist in the ipmi-oem component of FreeIPMI before version 1.6.17. The vulnerabilities are located in the response parsing logic for three specific OEM subcommands: 'dell get-last-post-code', 'supermicro extra-firmware-info', and 'wistron read-proprietary-string'. An attacker acting as a malicious IPMI responder can send a specially crafted response message that exceeds the allocated stack buffer during processing. This can lead to a denial of service (crash) or potentially arbitrary code execution. The issue was fixed in version 1.6.17 by implementing proper bounds checking on response lengths.

## Affected products

- GNU FreeIPMI before 1.6.17

## Timeline

- 2026-03-11: disclosed: Vulnerability reported to developers by Zhihan Zheng
- 2026-03-23: patched: Fixed in FreeIPMI version 1.6.17
- 2026-03-24: advisory: CVE-2026-33554 published

## References

- [https://ftp.gnu.org/gnu/freeipmi/](https://ftp.gnu.org/gnu/freeipmi/)
- [https://savannah.gnu.org/bugs/?68140](https://savannah.gnu.org/bugs/?68140)
- [https://savannah.gnu.org/bugs/?68141](https://savannah.gnu.org/bugs/?68141)
- [https://savannah.gnu.org/bugs/?68142](https://savannah.gnu.org/bugs/?68142)
- [http://www.openwall.com/lists/oss-security/2026/06/03/1](http://www.openwall.com/lists/oss-security/2026/06/03/1)