Intel Server Board D50DNP/M50FCP UEFI: out-of-bounds write in XmlCliCommonDxe allows firmware-level code execution

CVSS 8.7CVE-2026-56435Firmware, BMC & network fabric+1 more CVEscurated

Impact

Intel split this issue across two CVE ids with identical descriptions. They cover an out-of-bounds write in the XmlCliCommonDxe UEFI module on Intel D50DNP and M50FCP server boards. An attacker who already has privileged access to the node and can reach startup or SMM context may get code execution in firmware. That can compromise confidentiality, integrity and availability for the whole system. On a GPU node this means persistence below the OS, which survives reimaging between tenants. The attack is high complexity and needs high privileges first, so it is a way to deepen a compromise, not a way in.

Who can reach it

Local attacker who already holds high privileges (root or equivalent) on the host, with specific attack requirements present. No user interaction needed. Not reachable remotely or by an unprivileged tenant.

What to do

Update the D50DNP or M50FCP UEFI to R01.02.0006 or later (Intel download IDs 763516 for D50DNP and 775817 for M50FCP). This is a BIOS/firmware flash, so each node has to be taken out of service and rebooted. Intel lists no workaround.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2026-57882

References

https://nvd.nist.gov/vuln/detail/CVE-2026-56435 https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.