{"id":"CVE-2026-66334","kind":"vulnerability","aliases":["CVE-2026-66334"],"related":[],"title":"AMI Aptiov BIOS: out-of-bounds write by privileged local users","description":"AMI APTIOV contains vulnerabilities in BIOS where\nprivileged users may cause the “Out-of-Bounds Write” by\nlocal access. Successful exploitation of this vulnerability may lead to a\ndenial of service during firmware update processing, such as a crash or failed\nupdate if the out-of-bounds write hits unmapped memory. It could also impact Integrity, and Availability.","summary":"AMI Aptiov BIOS firmware contains an out-of-bounds write that a privileged local user can trigger. Successful exploitation may crash the machine or fail a firmware update, and it could also affect integrity and availability.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aptiov","bios","firmware","infrastructure","servers","workstations"],"not_affected_if":["no-local-privileged-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T17:17:46+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:24:07+00:00","updated_at":"2026-11-10T17:24:07+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T17:24:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AMI Aptiov BIOS: out-of-bounds write by privileged local users","impact":"medium","summary":"AMI Aptiov BIOS firmware contains an out-of-bounds write that a privileged local user can trigger. Successful exploitation may crash the machine or fail a firmware update, and it could also affect integrity and availability.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["bios","firmware","aptiov","servers","workstations"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local privileged user crashes firmware update or corrupts memory","analyst_note":"Find the AMI security bulletin and list affected Aptiov firmware versions and vendor BIOS updates; the NVD entry alone gives no version or fix data.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-privileged-access"],"who_is_affected":"Affects systems running AMI Aptiov BIOS firmware. Exploitation requires privileged local access to the machine, and the risk is mainly during firmware update processing. The sources do not list affected firmware versions or vendor fixes.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000695,"input_tokens":4589,"output_tokens":473,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-66334':15A,18A 'access':81C 'affect':58B 'also':57B,117C 'ami':1A,25B,62C 'aptiov':2A,19B,26B,63C 'avail':61B,121C 'bio':3A,20B,27B,67C 'bound':7A,34B,77C,110C 'caus':72C 'contain':29B,64C 'could':56B,116C 'crash':46B,101C 'cve':13A,16A 'denial':91C 'exploit':44B,83C 'fail':50B,103C 'firmwar':21B,28B,52B,95C 'hit':112C 'impact':118C 'infrastructur':22B 'integr':59B,119C 'lead':88C 'local':11A,39B,80C 'machin':48B 'may':45B,71C,87C 'memori':114C 'out-of-bound':4A,31B,74C,107C 'privileg':10A,38B,69C 'process':97C 'server':23B 'servic':93C 'success':43B,82C 'trigger':42B 'unmap':113C 'updat':53B,96C,104C 'user':12A,40B,70C 'vulner':65C,86C 'workstat':24B 'write':8A,35B,78C,111C","nicknames":[],"mitigations":[],"who_affected":"Affects systems running AMI Aptiov BIOS firmware. Exploitation requires privileged local access to the machine, and the risk is mainly during firmware update processing. The sources do not list affected firmware versions or vendor fixes.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aptiov","bios","firmware","infrastructure","medium","servers","workstations"],"campaign_type":null,"search_a":"'-2026':14A,17A '-66334':15A,18A 'ami':1A 'aptiov':2A 'bio':3A 'bound':7A 'cve':13A,16A 'local':11A 'out-of-bound':4A 'privileg':10A 'user':12A 'write':8A","search_b":"'affect':58B 'also':57B 'ami':25B 'aptiov':19B,26B 'avail':61B 'bio':20B,27B 'bound':34B 'contain':29B 'could':56B 'crash':46B 'exploit':44B 'fail':50B 'firmwar':21B,28B,52B 'infrastructur':22B 'integr':59B 'local':39B 'machin':48B 'may':45B 'out-of-bound':31B 'privileg':38B 'server':23B 'success':43B 'trigger':42B 'updat':53B 'user':40B 'workstat':24B 'write':35B","search_c":"'access':81C 'also':117C 'ami':62C 'aptiov':63C 'avail':121C 'bio':67C 'bound':77C,110C 'caus':72C 'contain':64C 'could':116C 'crash':101C 'denial':91C 'exploit':83C 'fail':103C 'firmwar':95C 'hit':112C 'impact':118C 'integr':119C 'lead':88C 'local':80C 'may':71C,87C 'memori':114C 'out-of-bound':74C,107C 'privileg':69C 'process':97C 'servic':93C 'success':82C 'unmap':113C 'updat':96C,104C 'user':70C 'vulner':65C,86C 'write':78C,111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"biossecurity@ami.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66334","severity":null,"published_at":"2026-11-10T17:17:46+00:00","modified_at":"2026-11-10T17:17:46+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}