AMI Aptio V BIOS: heap-based buffer overflow during firmware update processing

CVSS 6.8CVE-2026-66335Firmware, BMC & network fabriccurated

Impact

A privileged local user can trigger a heap-based buffer overflow in Aptio V's BIOS while it processes a firmware update. The stated result is a crash or failed update, and the description also lists confidentiality, integrity and availability impact. Many server boards ship Aptio V, so this can sit under a large part of a GPU fleet. A failed BIOS update can leave a node out of service until someone recovers it. AMI-SA-2026003 lists this as its own issue alongside CVE-2026-66334.

Who can reach it

Local user with high privileges, typically root or admin on the host OS, who can start firmware update processing. No user interaction needed.

What to do

Apply the BIOS update from your server OEM that includes the fix for AMI-SA-2026003. That means flashing firmware with the node out of service and rebooting it. The record names no fixed BIOS version. Until then, limit who can start firmware updates on the host.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-66335 https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026003.pdf

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.