FreeIPMI before version 1.6.19 contains a stack‑based buffer overflow in the function _ipmi_sel_oem_fujitsu_get_sel_entry_long_text. The overflow is triggered by malformed Fujitsu SEL long‑text responses, allowing an attacker to corrupt the stack and execute arbitrary code. This classic stack‑based buffer overflow vulnerability (CWE‑121) can compromise confidentiality, integrity, and availability of the system where FreeIPMI runs.

The affected product is FreeIPMI, FreeIPMI. All versions prior to 1.6.19 are vulnerable.

With a CVSS score of 9.8 the risk is high and the likelihood of exploitation is significant, although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending crafted IPMI SEL long‑text packets over the network to a system that has FreeIPMI running, potentially without requiring local privileges if IPMI is exposed. Failure to patch may allow remote code execution on exposed hosts.