---
id: "CVE-2026-14968"
page: "https://infrastack.ai/live/CVE-2026-14968"
kind: "vulnerability"
aliases: ["CVE-2026-14968"]
title: "EDK2 AMD MmSaveStateLib: out-of-bounds write in SMM save-state reads when the SysCall path is enabled"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "edk2 UefiCpuPkg MmSaveStateLib (AMD)", "fixed": [], "affected": ">= 64b62a08797295b2f5b6a394866be5533d3507d2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["amd", "bios", "edk2", "firmware", "infrastructure", "servers", "smm", "uefi", "workstations"]
not_affected_if: ["amdsyscalllibnull", "no-local-access", "non-amd-platform", "non-edk2-firmware"]
published_at: "2026-11-10T19:21:14+00:00"
first_seen_at: "2026-11-10T19:25:15+00:00"
updated_at: "2026-11-10T21:24:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14968", "first_seen_at": "2026-11-10T19:25:15+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T21:24:18+00:00"}]
exploit_sources: []
---

# EDK2 AMD MmSaveStateLib: out-of-bounds write in SMM save-state reads when the SysCall path is enabled

Link for people: https://infrastack.ai/live/CVE-2026-14968 (this .md is for agents)

In EDK2's UefiCpuPkg AMD MmSaveStateLib, the SysCall path of MmSaveStateReadRegisterByIndex() writes a full 4-byte value even when the caller asked for 1-3 or 5-7 bytes, corrupting adjacent SMM memory. It only runs when NeedSysCall() is TRUE; many open-source DSCs bind AmdSysCallLib to AmdSysCallLibNull, which returns FALSE. No patched release yet; a fix is proposed in PR #13444. No exploitation reported; the reporter's proof is an AddressSanitizer reproducer that mirrors the logic.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:edk2 UefiCpuPkg MmSaveStateLib (AMD) affected >= 64b62a08797295b2f5b6a394866be5533d3507d2 fixed no fixed version listed

## How to check

Only AMD-platform firmware builds that include UefiCpuPkg/Library/MmSaveStateLib/AmdMmSaveState.c from commit 64b62a08797295b2f5b6a394866be5533d3507d2 or later are in scope. In your firmware's .dsc, check that AmdSysCallLib resolves to a real implementation and not AmdSysCallLibNull (Null means NeedSysCall() is FALSE and the path is not used). Binary BIOS users: ask your board/OEM vendor whether their image is built from an affected EDK2 and enables the SysCall path.

## Fix

No patched version yet per the advisory (Patched versions: None). A fix is proposed in edk2 PR #13444 (not read). Until then, build with AmdSysCallLibNull where SysCall support is not needed, and watch for OEM BIOS updates.

## Timeline

- 2026-11-10T19:25:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14968
- 2026-11-10T21:24:18+00:00 analyst — Read tianocore GHSA-979r-6wfh-gq4h: AMD MmSaveStateLib SysCall OOB write, config-dependent, no patched release; PR #13444 referenced but not read. NVD description was vague and did not mention AMD.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tianocore/edk2/security/advisories/GHSA-979r-6wfh-gq4h

## From the sources

EDK2 contains vulnerabilities in
BIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise
SMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_