CVE-2026-14968
AMD MmSaveStateLib SysCall path performs out-of-bounds writes for partial save-state reads
Description
EDK2 contains vulnerabilities in BIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise SMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability.
INFO
Published Date :
Nov. 10, 2026, 6:50 p.m.
Last Modified :
Nov. 10, 2026, 6:50 p.m.
Remotely Exploit :
No
Source :
TianoCore
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | HIGH | 65518388-201a-4f93-8712-366d21fe8d2c |
Solution
- Update EDK2 BIOS firmware to the latest version.
- Apply provided vendor patches for EDK2.
- Review SMM handler code for vulnerabilities.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-14968 vulnerability anywhere in the article.