Intel Server Board D50DNP/M50FCP UEFI: XmlCliCommonDxe out-of-bounds write reachable from privileged system software

CVSS 8.7CVE-2026-57891Firmware, BMC & network fabriccurated

Impact

This is another out-of-bounds write in the XmlCliCommonDxe UEFI module on Intel D50DNP and M50FCP server boards. Unlike CVE-2026-56435, Intel describes the attacker here as a system software adversary, not one in startup or SMM context. A privileged attacker on the host may get code execution in firmware, with high impact on confidentiality, integrity and availability. On shared GPU nodes, firmware-level code survives OS reimaging between tenants. The attack is high complexity and needs high privileges first.

Who can reach it

Local attacker with high privileges in the host OS (system software), with specific attack requirements present. No user interaction needed. Not reachable by an unprivileged tenant or over the network.

What to do

Update the D50DNP or M50FCP UEFI to R01.02.0006 or later (Intel download IDs 763516 for D50DNP and 775817 for M50FCP). This is the same update that fixes CVE-2026-56435. It is a firmware flash, so each node has to be taken out of service and rebooted. Intel lists no workaround.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-57891 https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.