Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-65200— Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses

Quick assessment

Affected
Huawei openBMC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

openUBMC 的设备管理进程会解析来自总线上设备的 PLDM over MCTP 和 NCSI over MCTP 响应。在共享传输库中，三个响应解析器从设备提供的响应长度中减去一个固定的头部大小或保留字段大小，但未进行下界检查。当响应长度过小时，该无符号长度差值会发生回绕（wrap around），产生一个极大的值，随后解析器会远远超出响应缓冲区进行读取。受影响的代码位于基础的（非厂商自定义）PLDM 控制类以及华为 NCSI 驱动程序中，因此任何连接在内部管理总线上的 PLDM 端点或华为网卡均可触发此漏洞

CVSS 3.5 · Low EPSS 0.14% · P3

Affected Version Matrix 1

VendorProduct Version RangeStatus
Huawei openBMC ≤ 26.06 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-65200

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses
Source: CVE Program / CVE List V5
Vulnerability Description
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Huawei openBMC 0 ~ 26.06 -

II. Public POCs for CVE-2026-65200

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-65200

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-65200 (1)

Same Patch Batch · Huawei · 2026-10-13 · 3 CVEs total

CVE-2026-65198 8.6 HIGH Huawei Default SNMPv3 USM key
CVE-2026-65199 5.4 MEDIUM Huawei openUBMC low-privilege SNMP to administrator privilege escalation

IV. Related Vulnerabilities

Same product: openBMC
Same vendor: Huawei
Same weakness: CWE-191

V. Comments for CVE-2026-65200

No comments yet

Leave a comment