The vulnerability arises when the openUBMC device‑management process parses PLDM-over-MCTP and NCSI-over-MCTP responses that contain an undersized response length field. Three shared transport libraries subtract a fixed header or reserved‑field size from the supplied response length without performing a lower‑bound check. Because the length difference is wrapped as an unsigned value, the parser interprets the negative difference as a very large value and reads far past the end of the response buffer. The result is a heap read that can expose arbitrary memory contents. This defect is a classic integer underflow (CWE‑191).

Huawei openBMC systems using the openUBMC device‑management process are affected. The flaw resides in the base PLDM control class and the Huawei NCSI driver, so any PLDM endpoint or Huawei NIC that communicates over the internal management bus can trigger the bug. Devices that produce PLDM or NCSI-over-MCTP responses on the internal bus are therefore risky if the code path is exercised.

With a CVSS score of 3.5 the vulnerability is low severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating that it is not known to be actively exploited. Based on the description, it is inferred that the attacker would need direct access to the internal management bus or control an onboard device that can send malformed PLDM/NCSI responses, so the threat is primarily local or confined to environments where physical or privileged bus access is possible. An attacker could read sensitive memory, but the exploit does not provide elevation or code execution. The overall risk is modest, but it remains operationally relevant in tightly controlled environments.