Dell iDRAC9 xRC4 Length Underflow

Executive summary #

An authenticated IPMI user can trigger an approximately 64 KB out-of-bounds copy in the iDRAC9 session library when an IPMI 2.0 session negotiates an xRC4 confidentiality suite. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (5.9, Medium), and is an instance of CWE-191 (Integer Underflow or Wraparound) and CWE-787 (Out-of-bounds Write).

Technical details #

The xRC4 decryption routine subtracts a fixed 20-byte header from the received payload length without checking that the payload is large enough. The result is stored as a 16-bit value, so a payload shorter than the header underflows to a large length that is then used by the copy operation. Unlike the adjacent AES-CBC path, the xRC4 path does not reject undersized payloads. The affected iDRAC9 routine is in libsess.so.9.9.9; the corresponding code is present but not reachable on iDRAC10 1.30.10.50, whose offered cipher suites do not include xRC4.

Attacker value #

An authenticated user able to negotiate xRC4 can cause memory corruption in the IPMI session-control process, which runs as the unprivileged ipmi-gateway user. The defect could potentially enable code execution, but that outcome has not been assessed. Exploitation depends on xRC4 being enabled in the target's runtime cipher-suite configuration.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure