Huawei openBMC Out-of-Bounds Heap Read in PLDM/NCSI Parser (CVE-2026-65198/9/0)

Vulnerability Overview Malicious PLDM or NCSI devices on Huawei systems can trigger out-of-bounds heap reads via short MCTP responses. This vulnerability relates to processing issues in the openBMC device management daemon when parsing PLDM-over-MCTP and NCSI-over-MCTP responses. Affected Scope Vendor: Huawei Product: Huawei openBMC 26.06 Related CVEs: CVE-2026-65198, CVE-2026-65199, CVE-2026-65200 Technical Details 1. PLDM-over-MCTP Parser: - In , when , it passes . - In the function, and are dereferenced, and is read after checking . - When is between 1 and 3, results in a negative value, causing the CRC routine to read out of bounds. - In the function, . If , the loop reads out of bounds. 2. NCSI-over-MCTP Parser: - In , when , it calculates . - After the check, executes a large out-of-bounds heap read. Attacker Value An attacker can cause a denial of service during device discovery or log collection by returning truncated PLDM or NCSI responses. This may trigger invalid memory reads or resource exhaustion, potentially crashing the BMC device management service. Remediation Coordinated Disclosure: This issue was discovered by HD Moores, assisted by AI tools. Disclosure was coordinated by Tod Beardsley. Timeline: - 2026-07-18: Initial discovery and recording - 2026-07-21: CVE-2026-65200 reserved - 2026-08-05: Disclosure to CISA - 2026-08-28: CISA declined coordination - 2026-10-13: Public disclosure Proof of Concept (POC) Code Summary This vulnerability involves out-of-bounds heap reads in Huawei's openBMC device management daemon when processing PLDM-over-MCTP and NCSI-over-MCTP responses. An attacker can cause denial of service or potential information leakage by returning truncated responses. Remediation includes coordinated disclosure and public disclosure.

Goal Reached Thanks to every supporter — we hit 100%!

Huawei openBMC Out-of-Bounds Heap Read in PLDM/NCSI Parser (CVE-2026-65198/9/0)