TianoCore EDK II: Information disclosure of SMM memory via transient execution
Summary
EDK II, the UEFI firmware implementation used by many BIOS vendors, is affected by a Transient Scheduler Attack (TSA) mitigation gap. A local attacker with administrative or kernel-level privileges can infer residual microarchitectural state left by System Management Mode (SMM) execution and may disclose SMRAM contents. Exploitation requires local access, high privileges and high attack complexity, and the impact is limited to confidentiality.
Affected
- TianoCore EDK II, versions 0 through edk2-stable202608
- Firmware and BIOS images built on affected EDK II code, including AMD platforms according to the GHSA advisory
- Default configuration: unaffected according to the CNA record
Fixed in
Unknown. No fixed EDK II release or vendor firmware update has been identified yet.
Workaround
Unknown. No documented workaround has been identified. Check the GHSA advisory and AMD-SB-7072 for guidance.
Exploitation
- No known exploitation in the wild.
- No public proof of concept identified for this CVE.
- The advisory references a PoC attached to the report, which has not been independently verified.
Our recommendation
- Low priority for most SMEs, since exploitation is local and requires high privileges.
- Give higher priority to shared, multi-tenant and virtualisation hosts.
- Ask server and PC vendors for BIOS/UEFI and microcode updates that address this issue and install them once available.
- Keep the operating system and hypervisor current and restrict local administrative access.
- Monitor the EDK II GHSA advisory and AMD-SB-7072 for a fixed version.
- Do not confuse this issue with the separate PXE flaw CVE-2026-97631.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-18448 www.cve.org
- GitHub Security Advisory GHSA-7v86-66vf-h88j github.com
- AMD Product Security www.amd.com
- VulDB 434204 vuldb.com
- SecurityWeek: Chipmaker Patch Tuesday www.securityweek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:03.
Original description (NVD)
EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also impact Confidentiality.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.