AMI AptioV BIOS: integer overflow leads to memory corruption and firmware code execution

CVSS 7.1CVE-2025-58771Firmware, BMC & network fabriccurated

Impact

An integer overflow or wraparound in the BIOS leads to undersized allocations and memory corruption, which AMI says can reach arbitrary code execution inside firmware. The exposure requires high privileges and the vector is rated high complexity, so this is a platform-hardening item rather than something a tenant workload reaches - but firmware execution still undercuts every isolation layer above it, which matters on shared GPU hosts. AptioV underpins many OEM server BIOS builds, so fleet exposure depends on which BIOS lineage your nodes ship. Kept separate from the other AptioV ids in this advisory because the flaw class, privilege requirement and score differ.

Who can reach it

Local access, high privileges already required, high attack complexity (AV:L/AC:H/PR:H). Practically an administrator or a process already running with elevated platform access.

What to do

Obtain the fixed BIOS build from the server OEM that ships your AptioV-derived firmware; AMI-SA-2026002 is the upstream advisory. The fix is a BIOS flash: drain the node, flash with the host out of service, reboot. Given the high-privilege precondition this can usually ride along with the next scheduled firmware maintenance rather than an emergency window. No fixed version appears in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-58771 https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026002.pdf

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.