Intel Server Board D50DNP and M50FCP: Out-of-bounds write in UEFI firmware
Summary
An out-of-bounds write in the XmlCliCommonDxe component of the Ring 0 UEFI firmware on Intel Server Board D50DNP and M50FCP may allow privilege escalation. An attacker needs local access, high privileges and a high-complexity condition involving startup code or an SMM adversary. If successful, the attacker could execute code and fully compromise confidentiality, integrity and availability of the system.
Affected
- Intel Server Board D50DNP and M50FCP with UEFI firmware before R01.02.0006
- Advisory INTEL-SA-01554 also references CVE-2026-57882 and CVE-2026-57891 (same component, same CVSS 8.7), and CVE-2026-55716 and CVE-2026-50249 (out-of-bounds reads, CVSS 5.6)
Fixed in
- UEFI firmware R01.02.0006 or later
Workaround
Unknown.
Exploitation
- No public exploitation or proof of concept known at the time of writing.
- Not listed in CISA KEV as far as known.
Our recommendation
- Check whether D50DNP or M50FCP servers are in use and record their UEFI firmware version.
- Update the UEFI firmware to R01.02.0006 or later using the Intel download pages.
- Until updated, restrict local administrator and root access to these servers.
- Re-check the NVD entry and the Intel advisory once the analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Advisory INTEL-SA-01554 intel.com
- Intel D50DNP and M50FCP Specifications Update cdrdv2-public.intel.com
- Intel Server Board D50DNP Support www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:23.
Original description (NVD)
Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.