AMI AptioV BIOS: out-of-bounds write enables firmware memory corruption and code execution

CVSS 7.1CVE-2025-58773Firmware, BMC & network fabriccurated

Impact

An out-of-bounds write in the BIOS corrupts firmware memory and can be driven to arbitrary code execution with full confidentiality, integrity and availability impact on the vulnerable component. The record requires high privileges and rates complexity high, so the realistic abuse case is an administrator-level foothold being converted into firmware persistence beneath the OS - a serious problem for a GPU host that is supposed to be wiped and handed to the next tenant. AptioV is the UEFI base behind many OEM server BIOS releases, so exposure tracks your BIOS lineage rather than AMI branding on the box. Listed separately from the other AptioV ids in this advisory because the flaw class and vector differ.

Who can reach it

Local access with high privileges and high attack complexity (AV:L/AC:H/PR:H, no user interaction).

What to do

Take the fixed BIOS from your server OEM; AMI advisory AMI-SA-2026002 is the upstream reference. Remediation is a firmware flash per node - drain, flash out of service, reboot - and there is no documented runtime mitigation. The record names no fixed version; confirm against OEM BIOS release notes.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-58773 https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026002.pdf

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.