{"id":"CVE-2026-14968","kind":"vulnerability","aliases":["CVE-2026-14968"],"related":[],"title":"EDK2 BIOS firmware: out-of-bounds write lets a local user break SMM","description":"EDK2 contains vulnerabilities in\nBIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise\nSMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability.","summary":"EDK2, the open-source firmware code used in many computer BIOS images, has an out-of-bounds write flaw. A privileged local user or attacker can corrupt SMM handler integrity, causing instability, denial of service, or loss of integrity.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bios","edk2","firmware","infrastructure","servers","workstations"],"not_affected_if":["no-local-access","non-edk2-firmware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:14+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","triaged_at":"2026-11-10T19:50:09+00:00","updated_at":"2026-11-10T19:50:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:50:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"EDK2 BIOS firmware: out-of-bounds write lets a local user break SMM","impact":"high","summary":"EDK2, the open-source firmware code used in many computer BIOS images, has an out-of-bounds write flaw. A privileged local user or attacker can corrupt SMM handler integrity, causing instability, denial of service, or loss of integrity.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["firmware","bios","edk2","servers","workstations"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local privileged attacker corrupts SMM handler and crashes the system","analyst_note":"Find the vendor advisory (github.com linked page) for affected firmware versions and the EDK2 patched commit or release.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-access","non-edk2-firmware"],"who_is_affected":"Systems running firmware built from EDK2 are exposed, which covers many x86 server and workstation BIOS images. Exploitation needs local access with privileges, so remote-only servers are less exposed. The sources do not name specific vendor firmware versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4584,"output_tokens":478,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the vendor advisory (github.com linked page) for affected firmware versions and the EDK2 patched commit or release.","search":"'-14968':17A,20A '-2026':16A,19A 'access':89C 'also':111C 'attack':53B,79C 'avail':115C 'bio':2A,21B,38B,72C 'bound':7A,45B,85C 'break':13A 'caus':59B,81C,100C 'code':33B 'compromis':96C 'comput':37B 'contain':69C 'corrupt':55B 'could':95C,110C 'cve':15A,18A 'denial':61B,106C 'edk2':1A,22B,27B,68C 'exploit':91C 'firmwar':3A,23B,32B 'flaw':47B 'handler':57B,98C 'imag':39B 'impact':112C 'infrastructur':24B 'instabl':60B,102C 'integr':58B,67B,99C,113C 'lead':104C 'let':9A 'local':11A,50B,88C 'loss':65B 'mani':36B 'may':80C 'open':30B 'open-sourc':29B 'out-of-bound':4A,42B,82C 'privileg':49B,76C 'server':25B 'servic':63B,108C 'skill':74C 'smm':14A,56B,97C 'sourc':31B 'success':90C 'system':101C 'use':34B 'user':12A,51B,77C 'vulner':70C,94C 'workstat':26B 'write':8A,46B,86C","nicknames":[],"mitigations":[],"who_affected":"Systems running firmware built from EDK2 are exposed, which covers many x86 server and workstation BIOS images. Exploitation needs local access with privileges, so remote-only servers are less exposed. The sources do not name specific vendor firmware versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bios","edk2","firmware","high","infrastructure","servers","workstations"],"campaign_type":null,"search_a":"'-14968':17A,20A '-2026':16A,19A 'bio':2A 'bound':7A 'break':13A 'cve':15A,18A 'edk2':1A 'firmwar':3A 'let':9A 'local':11A 'out-of-bound':4A 'smm':14A 'user':12A 'write':8A","search_b":"'attack':53B 'bio':21B,38B 'bound':45B 'caus':59B 'code':33B 'comput':37B 'corrupt':55B 'denial':61B 'edk2':22B,27B 'firmwar':23B,32B 'flaw':47B 'handler':57B 'imag':39B 'infrastructur':24B 'instabl':60B 'integr':58B,67B 'local':50B 'loss':65B 'mani':36B 'open':30B 'open-sourc':29B 'out-of-bound':42B 'privileg':49B 'server':25B 'servic':63B 'smm':56B 'sourc':31B 'use':34B 'user':51B 'workstat':26B 'write':46B","search_c":"'access':89C 'also':111C 'attack':79C 'avail':115C 'bio':72C 'bound':85C 'caus':81C,100C 'compromis':96C 'contain':69C 'could':95C,110C 'denial':106C 'edk2':68C 'exploit':91C 'handler':98C 'impact':112C 'instabl':102C 'integr':99C,113C 'lead':104C 'local':88C 'may':80C 'out-of-bound':82C 'privileg':76C 'servic':108C 'skill':74C 'smm':97C 'success':90C 'system':101C 'user':77C 'vulner':70C,94C 'write':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T02:36:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"infosec@edk2.groups.io","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14968","severity":null,"published_at":"2026-11-10T19:21:14+00:00","modified_at":"2026-11-10T19:21:14+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","fetched_at":"2026-11-10T19:25:15+00:00","note":null}],"documents":[{"id":117514,"url":"https://github.com/tianocore/edk2/security/advisories/GHSA-979r-6wfh-gq4h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T02:36:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}