CVE-2026-65200: Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed where the openUBMC device-management process communicates with PLDM endpoints or a Huawei NIC over the internal management bus. The affected paths include the base PLDM control class and the Huawei NCSI driver.
What does an attacker need to exploit it?
An attacker needs to control or introduce an on-bus PLDM or NCSI device that can return an undersized MCTP response. No authentication or user interaction is indicated by the supplied vector.