{"id":"CVE-2026-66335","kind":"vulnerability","aliases":["CVE-2026-66335"],"related":[],"title":"AMI Aptio BIOS: heap overflow by privileged local user","description":"AMI APTIOV contains vulnerabilities in BIOS where\nprivileged users may cause the “Heap-based Buffer Overflow” by local access.\nSuccessful exploitation of this vulnerability may lead to a denial of service\nduring firmware update processing, such as a crash or failed update if the\nout-of-bounds write hits unmapped memory. It could also impact Confidentiality,\nIntegrity, and Availability.","summary":"AMI Aptio BIOS firmware has a heap-based buffer overflow that a privileged local user can trigger. Successful exploitation may crash firmware update processing or failed updates, and could also affect confidentiality, integrity and availability.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ami-aptio","bios","firmware","infrastructure","servers","workstations"],"not_affected_if":["remote-only-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T17:17:46+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:24:07+00:00","updated_at":"2026-11-10T17:24:07+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T17:24:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AMI Aptio BIOS: heap overflow by privileged local user","impact":"medium","summary":"AMI Aptio BIOS firmware has a heap-based buffer overflow that a privileged local user can trigger. Successful exploitation may crash firmware update processing or failed updates, and could also affect confidentiality, integrity and availability.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["bios","firmware","ami-aptio","servers","workstations"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local privileged user crashes firmware update or corrupts memory","analyst_note":"Find the AMI security bulletin for this CVE to confirm affected Aptio versions, fixed firmware and how to check exposure.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["remote-only-access"],"who_is_affected":"Systems running AMI Aptio firmware, which the sources do not enumerate by board or version. Exposure requires local access with privileges already held, so remote-only systems are less exposed. The sources do not say which configurations can be skipped.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":4600,"output_tokens":458,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-66335':12A,15A 'access':79C 'affect':55B 'also':54B,115C 'ami':1A,17B,24B,60C 'ami-aptio':16B 'aptio':2A,18B,25B 'aptiov':61C 'avail':59B,120C 'base':32B,74C 'bio':3A,19B,26B,65C 'bound':108C 'buffer':33B,75C 'caus':70C 'confidenti':56B,117C 'contain':62C 'could':53B,114C 'crash':45B,99C 'cve':10A,13A 'denial':89C 'exploit':43B,81C 'fail':50B,101C 'firmwar':20B,27B,46B,93C 'heap':4A,31B,73C 'heap-bas':30B,72C 'hit':110C 'impact':116C 'infrastructur':21B 'integr':57B,118C 'lead':86C 'local':8A,38B,78C 'may':44B,69C,85C 'memori':112C 'out-of-bound':105C 'overflow':5A,34B,76C 'privileg':7A,37B,67C 'process':48B,95C 'server':22B 'servic':91C 'success':42B,80C 'trigger':41B 'unmap':111C 'updat':47B,51B,94C,102C 'user':9A,39B,68C 'vulner':63C,84C 'workstat':23B 'write':109C","nicknames":[],"mitigations":[],"who_affected":"Systems running AMI Aptio firmware, which the sources do not enumerate by board or version. Exposure requires local access with privileges already held, so remote-only systems are less exposed. The sources do not say which configurations can be skipped.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amiaptio","bios","firmware","infrastructure","medium","servers","workstations"],"campaign_type":null,"search_a":"'-2026':11A,14A '-66335':12A,15A 'ami':1A 'aptio':2A 'bio':3A 'cve':10A,13A 'heap':4A 'local':8A 'overflow':5A 'privileg':7A 'user':9A","search_b":"'affect':55B 'also':54B 'ami':17B,24B 'ami-aptio':16B 'aptio':18B,25B 'avail':59B 'base':32B 'bio':19B,26B 'buffer':33B 'confidenti':56B 'could':53B 'crash':45B 'exploit':43B 'fail':50B 'firmwar':20B,27B,46B 'heap':31B 'heap-bas':30B 'infrastructur':21B 'integr':57B 'local':38B 'may':44B 'overflow':34B 'privileg':37B 'process':48B 'server':22B 'success':42B 'trigger':41B 'updat':47B,51B 'user':39B 'workstat':23B","search_c":"'access':79C 'also':115C 'ami':60C 'aptiov':61C 'avail':120C 'base':74C 'bio':65C 'bound':108C 'buffer':75C 'caus':70C 'confidenti':117C 'contain':62C 'could':114C 'crash':99C 'denial':89C 'exploit':81C 'fail':101C 'firmwar':93C 'heap':73C 'heap-bas':72C 'hit':110C 'impact':116C 'integr':118C 'lead':86C 'local':78C 'may':69C,85C 'memori':112C 'out-of-bound':105C 'overflow':76C 'privileg':67C 'process':95C 'servic':91C 'success':80C 'unmap':111C 'updat':94C,102C 'user':68C 'vulner':63C,84C 'write':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T17:17:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"biossecurity@ami.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66335","severity":null,"published_at":"2026-11-10T17:17:46+00:00","modified_at":"2026-11-10T17:17:46+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}