Dell iDRAC9 IPMI Buffer Overflow

Executive summary #

An authenticated iDRAC9 administrator can cause an IPMI OEM command to overrun its response buffer and disclose adjacent uninitialized process memory. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L (4.7, Medium), and is an instance of CWE-787 (Out-of-bounds Write) and CWE-908 (Use of Uninitialized Resource).

Technical details #

The Dell DellGetSpdDimmInfo OEM command (NetFn 0x30, command 0xB8) uses a request-supplied count as a copy length on the modern-generation command path. Unlike sibling paths, this path does not validate the count against the response-buffer size before copying. The oversized response also includes stack bytes not initialized with SPD data. The vulnerable path is reachable on iDRAC9 7.20.10.50; a generation check gates it off on iDRAC10 1.30.10.50.

Attacker value #

An authenticated administrator can read adjacent process memory returned in the IPMI response while also corrupting the response buffer. The memory corruption could potentially enable code execution, but that outcome has not been assessed.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure