EDK2: out-of-bounds write reachable from a privileged local user compromises SMM handler integrity

CVSS 7.0CVE-2026-14968Firmware, BMC & network fabriccurated

Impact

An out-of-bounds write in EDK2 lets a privileged local attacker break the integrity of an SMM handler, cause instability, or crash the system. SMM runs below the OS and the hypervisor, so a corrupted SMM handler is a foothold that a host reimage would not clear. Many server OEM BIOSes are built on EDK2, but the record does not say which module is affected or which platforms ship it.

Who can reach it

A local attacker who already has high privileges on the host (root or kernel-level) and can trigger SMM calls. No remote vector is described.

What to do

Watch for server OEM BIOS/UEFI updates that include the EDK2 fix in GHSA-979r-6wfh-gq4h, then flash the firmware with each node out of service. The record names no fixed EDK2 revision or affected OEM builds. Until an update ships, limiting who holds root on bare-metal hosts is the only mitigation.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-14968 https://github.com/tianocore/edk2/security/advisories/GHSA-979r-6wfh-gq4h

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.