Intel Server Board D50DNP and M50FCP: Out-of-bounds read in UEFI firmware
Summary
Intel Server Board D50DNP and M50FCP are affected by an out-of-bounds read in the CheckUefiVgaMode component of the Ring 0 UEFI firmware. A local attacker with high privileges, using startup code or an SMM adversary and a high attack complexity, can read sensitive data from memory (information disclosure). Confidentiality is the only impact, and the attack requires no user interaction. Intel's advisory INTEL-SA-01554 covers this issue together with several related CVEs, and the boards are end-of-life.
Affected
- Intel Server Board D50DNP UEFI firmware before R01.02.0006 (per Intel advisory INTEL-SA-01554)
- Intel Server Board M50FCP UEFI firmware before R01.02.0006 (per Intel advisory INTEL-SA-01554)
- Exact affected version ranges in the CVE record: See references
Fixed in
- Intel states that UEFI firmware R01.02.0006 or later fixes the issue for these boards. Confirm this against the advisory.
- Intel states that no further updates will be provided for D50DNP and M50FCP after October 15, 2026. Whether a fix is available for this CVE is therefore uncertain.
Workaround
- Unknown. Intel's advisory was not readable during research, so no vendor-confirmed workaround is available.
- Restrict privileged local, BMC, console and SSH access to a small group of administrators.
- Keep BIOS and BMC settings locked and monitor for unexpected firmware changes.
Exploitation
- Not known to be exploited in the wild (as of the research date).
- No public proof of concept found.
- CISA KEV listing: not checked.
Our recommendation
- Inventory all D50DNP and M50FCP boards and record their UEFI firmware versions.
- Update to R01.02.0006 or later where available, and check the Intel advisory for confirmation.
- Because vendor support has ended, plan to replace the hardware.
- Restrict and monitor administrative access until the boards are replaced.
- Watch the NVD and CISA KEV entries for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01554 intel.com
- Strix AI: CVE-2026-55716 www.strix.ai
- OffSeq Radar: CVE-2026-55716 radar.offseq.com
- Intel D50DNP BIOS and Firmware Update Package (R01.02.0006) www.intel.com
- Intel M50FCP board support page www.intel.com
- Intel M50FCP SFUP end-of-support notice www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:05.
Original description (NVD)
Out-of-bounds read in the CheckUefiVgaMode for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an information disclosure. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.