CVE-2026-65200
3.5LowPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-191
Impact
A malicious device on the internal management bus can trigger out-of-bounds reads in the openUBMC device-management process, leading to a crash or information disclosure. The attacker needs physical access or compromised hardware attached to the MCTP bus.
Root cause
Response parsers in shared transport libraries subtract header lengths from device-supplied payload lengths without checking for underflow, causing an integer wrap and an out-of-bounds buffer read.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Fix & remediation
Upgrade openUBMC firmware once patched releases are provided by Huawei; if updates are unavailable, isolate or disconnect untrusted PLDM endpoints and Huawei NICs from the internal management bus.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.