What is CVE-2026-18857?

CVE-2026-18857 is a low-severity vulnerability in IBM Openbmc, classified under Out-of-bounds Read. CVSS score: 3.4/10. Published 2026-09-24.

How severe is CVE-2026-18857?

Low severity. CVSS v3 base score is 3.4 out of 10.

Out-of-bounds Read in IBM Openbmc

CVE-2026-18857

IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.

Vulnerability class: Buffer Overflow

Published 2026-09-24 · last modified 2026-09-24.

CVSS v3 metric

CVSS v3 base score 3.4 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

IBM Openbmc

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

www.ibm.com/support/pages/node/7289253 (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-18857?: CVE-2026-18857 is a low-severity vulnerability in IBM Openbmc, classified under Out-of-bounds Read. CVSS score: 3.4/10. Published 2026-09-24.
How severe is CVE-2026-18857?: Low severity. CVSS v3 base score is 3.4 out of 10.