{"id":"CVE-2026-18448","kind":"vulnerability","aliases":["CVE-2026-18448"],"related":[],"title":"EDK2 BIOS firmware flaw lets a privileged local user read SMRAM","description":"EDK2 contains a vulnerability in BIOS\nwhere a privileged attacker may cause “Exposure of Sensitive Information during\nTransient Execution” by local access. Successful exploitation of\nthis vulnerability may result in disclosure of SMRAM contents. It could also impact Confidentiality.","summary":"EDK2, the open-source UEFI firmware code used in many computers' BIOS, has a transient-execution flaw that lets a privileged attacker with local access leak sensitive information. Successful exploitation can disclose SMRAM contents, which are protected system-management memory.","severity":"medium","cvss":5.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bios","edk2","firmware","infrastructure","uefi"],"not_affected_if":["remote-only-attack-surface"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:15+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","triaged_at":"2026-11-10T20:00:17+00:00","updated_at":"2026-11-10T20:00:17+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:00:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"EDK2 BIOS firmware flaw lets a privileged local user read SMRAM","impact":"medium","summary":"EDK2, the open-source UEFI firmware code used in many computers' BIOS, has a transient-execution flaw that lets a privileged attacker with local access leak sensitive information. Successful exploitation can disclose SMRAM contents, which are protected system-management memory.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["edk2","uefi","bios","firmware"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local privileged attacker reads SMRAM memory contents","analyst_note":"Find affected EDK2 versions and vendor firmware fixes via the vendor advisory on github.com and the NVD entry.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["remote-only-attack-surface"],"who_is_affected":"Only machines running firmware built from the affected EDK2 code are exposed, and an attacker needs privileged local access first. The sources do not name the affected EDK2 versions or which hardware vendors ship them, so teams should check with their server or device vendor for firmware updates. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4573,"output_tokens":484,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-18448':14A,17A '-2026':13A,16A 'access':49B,87C 'also':102C 'attack':46B,75C 'bio':2A,18B,35B,71C 'caus':77C 'code':30B 'comput':34B 'confidenti':104C 'contain':67C 'content':58B,99C 'could':101C 'cve':12A,15A 'disclos':56B 'disclosur':96C 'edk2':1A,19B,23B,66C 'execut':40B,84C 'exploit':54B,89C 'exposur':78C 'firmwar':3A,20B,29B 'flaw':4A,41B 'impact':103C 'inform':52B,81C 'infrastructur':21B 'leak':50B 'let':5A,43B 'local':8A,48B,86C 'manag':64B 'mani':33B 'may':76C,93C 'memori':65B 'open':26B 'open-sourc':25B 'privileg':7A,45B,74C 'protect':61B 'read':10A 'result':94C 'sensit':51B,80C 'smram':11A,57B,98C 'sourc':27B 'success':53B,88C 'system':63B 'system-manag':62B 'transient':39B,83C 'transient-execut':38B 'uefi':22B,28B 'use':31B 'user':9A 'vulner':69C,92C","nicknames":[],"mitigations":[],"who_affected":"Only machines running firmware built from the affected EDK2 code are exposed, and an attacker needs privileged local access first. The sources do not name the affected EDK2 versions or which hardware vendors ship them, so teams should check with their server or device vendor for firmware updates. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bios","edk2","firmware","infrastructure","medium","uefi"],"campaign_type":null,"search_a":"'-18448':14A,17A '-2026':13A,16A 'bio':2A 'cve':12A,15A 'edk2':1A 'firmwar':3A 'flaw':4A 'let':5A 'local':8A 'privileg':7A 'read':10A 'smram':11A 'user':9A","search_b":"'access':49B 'attack':46B 'bio':18B,35B 'code':30B 'comput':34B 'content':58B 'disclos':56B 'edk2':19B,23B 'execut':40B 'exploit':54B 'firmwar':20B,29B 'flaw':41B 'inform':52B 'infrastructur':21B 'leak':50B 'let':43B 'local':48B 'manag':64B 'mani':33B 'memori':65B 'open':26B 'open-sourc':25B 'privileg':45B 'protect':61B 'sensit':51B 'smram':57B 'sourc':27B 'success':53B 'system':63B 'system-manag':62B 'transient':39B 'transient-execut':38B 'uefi':22B,28B 'use':31B","search_c":"'access':87C 'also':102C 'attack':75C 'bio':71C 'caus':77C 'confidenti':104C 'contain':67C 'content':99C 'could':101C 'disclosur':96C 'edk2':66C 'execut':84C 'exploit':89C 'exposur':78C 'impact':103C 'inform':81C 'local':86C 'may':76C,93C 'privileg':74C 'result':94C 'sensit':80C 'smram':98C 'success':88C 'transient':83C 'vulner':69C,92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T02:44:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"infosec@edk2.groups.io","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18448","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18448","severity":null,"published_at":"2026-11-10T19:21:15+00:00","modified_at":"2026-11-10T19:21:15+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","fetched_at":"2026-11-10T19:25:15+00:00","note":null}],"documents":[{"id":117515,"url":"https://github.com/tianocore/edk2/security/advisories/GHSA-7v86-66vf-h88j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T02:44:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}