AMI AptioV BIOS: classic buffer overflow permits local firmware-level code execution

CVSS 8.2CVE-2025-58772Firmware, BMC & network fabriccurated

Impact

A local user can overflow a fixed-size buffer in the BIOS and corrupt firmware memory, which AMI states can lead to arbitrary code execution with confidentiality, integrity and availability impact. Because AptioV is the UEFI base many server OEMs ship, this is a platform-integrity issue on whatever share of a fleet carries that BIOS lineage, and firmware-level execution sits below the OS and hypervisor that a GPU cloud relies on for tenant separation. The CVSS vector marks high availability impact to both the vulnerable system and the subsequent system, so a failed or abused code path can leave a GPU node unbootable. This is tracked separately from the other AptioV bugs in the same advisory because the flaw class and the scoring differ.

Who can reach it

Local access with low privileges (AV:L/PR:L, no user interaction). The record describes no remote or BMC-side reachability.

What to do

Get a fixed BIOS image from your server OEM; AMI advisory AMI-SA-2026002 is the upstream notice and OEMs republish the fix as a BIOS update. Applying it means draining the node, flashing the BIOS with the host out of service and rebooting - plan a maintenance window per affected node. No fixed version is named in the record, so confirm the target build against the OEM's release notes.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-58772 https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026002.pdf

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.