TianoCore EDK II: Out-of-bounds write in AMD SMM save-state handling
Summary
EDK II firmware code for AMD platforms writes four bytes into buffers when a partial-width (1-3 or 5-7 byte) save-state register is read through the SysCall path. A local attacker with high privileges can corrupt adjacent SMM/MM memory, which may cause instability, denial of service or, depending on memory layout, code execution in SMM. The vulnerable path is only active when a non-null AmdSysCallLib is configured and NeedSysCall() returns TRUE.
Affected
- TianoCore EDK II versions 0 up to and including edk2-stable202608 (per CVE record)
- Vulnerable code: UefiCpuPkg/Library/MmSaveStateLib/AmdMmSaveState.c, introduced by commit 64b62a08797295b2f5b6a394866be5533d3507d2
- Only builds with a non-null AmdSysCallLib and enabled SysCall path are affected; default builds with AmdSysCallLibNull are not
- Affected firmware products depend on the OEM build; verify with your hardware vendor
Fixed in
Unknown.
- Fix proposed in GitHub PR #13444; merge status and stable release containing it are not verified
- Check the GHSA advisory and your hardware vendor for a fixed BIOS/UEFI version
Workaround
Unknown.
- No vendor-documented workaround is known
- Limit local administrative and physical access to affected systems
Exploitation
- No evidence of exploitation in the wild found
- Not listed in CISA KEV at the time of research
- No public proof-of-concept exploit found; the fix PR describes the root cause in detail
Our recommendation
- Inventory AMD-based servers and workstations and record their firmware versions
- Monitor the GHSA advisory, PR #13444 and your hardware vendors for fixed BIOS/UEFI releases
- Apply OEM firmware updates as soon as they are available
- Restrict local administrator and physical access to servers and management hosts in the meantime
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-979r-6wfh-gq4h github.com
- CVE Record CVE-2026-14968 www.cve.org
- EDK2 fix pull request #13444 github.com
- Strix CVE summary www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:16.
Original description (NVD)
EDK2 contains vulnerabilities in BIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise SMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.