CVE-2026-65200 Details
Description
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.
An integer underflow vulnerability has been identified in the openUBMC device-management process on Huawei NICs, specifically in version 26.06. The issue arises in the parsing of PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices. Three response parsers in the shared transport libraries improperly handle device-supplied response lengths by subtracting a fixed header or reserved-field size without ensuring a minimum length. This oversight allows an undersized response to wrap the unsigned length difference, resulting in the parser reading far beyond the response buffer. The vulnerability is present in the base PLDM control class and the Huawei NCSI driver, making it accessible from any PLDM endpoint or Huawei NIC on the internal management bus.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026CNA
Assessed Jan 1, 1References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.runzero.com/advisories/huawei-malicious-device-integer-underflow-cve-2026-65200 | runZero | AdvisoryBundleTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | runZero |
Affected Products
| Product | Versions |
|---|---|
| Huawei openUBMC | 26.06 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | runZero |