AMI Aptio V BIOS: out-of-bounds write during firmware update processing

Impact

A privileged local user can trigger an out-of-bounds write in Aptio V's BIOS while it processes a firmware update. The stated result is a crash or failed update, with high integrity and availability impact. Many server boards ship Aptio V, so this can sit under a large part of a GPU fleet. A failed BIOS update can leave a node out of service until someone recovers it.

Who can reach it

Local user with high privileges, typically root or admin on the host OS, who can start firmware update processing. No user interaction needed.

What to do

Apply the BIOS update from your server OEM that includes the fix for AMI-SA-2026003. That means flashing firmware with the node out of service and rebooting it. The record names no fixed BIOS version. Until then, limit who can start firmware updates on the host.

References

Related entries

• AMI Aptio V BIOS: heap-based buffer overflow during firmware update processingCVE-2026-66335 · AMI Aptio V BIOS (firmware update processing)Medium
• Dell OMSA: improper certificate validation allows adjacent-network interception of management trafficCVE-2026-81447 · Dell OpenManage Server Administrator (TLS certificate validation)Medium
• Dell OpenManage Enterprise: improper signature verification allows code execution by an adminCVE-2026-91908 · Dell OpenManage Enterprise (cryptographic signature verification)Medium
• Dell OpenManage Enterprise: unsanitized output injects script into a downstream componentCVE-2026-91915 · Dell OpenManage Enterprise (injection into a downstream component)Medium
• OpenBMC bmcweb mTLS client-certificate UPN validation: Where mTLS is configured, bmcweb matches the certificate's UPNNCVD-2026-004-openbmc-bmcweb-mtls-client-certi · OpenBMC bmcweb mTLS client-certificate UPN validationMedium
• Cisco NX-OS CLI: CLI command injection giving root-level execution on the switch OS for an authenticated adminCVE-2017-12334 · Cisco NX-OS CLIMedium