CVE-2026-14968

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14968", "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c", "state": "PUBLISHED", "assignerShortName": "TianoCore", "dateReserved": "2026-07-07T15:14:21.318Z", "datePublished": "2026-11-10T18:50:37.286Z", "dateUpdated": "2026-11-10T18:50:37.286Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "65518388-201a-4f93-8712-366d21fe8d2c", "shortName": "TianoCore", "dateUpdated": "2026-11-10T18:50:37.286Z"}, "title": "AMD MmSaveStateLib SysCall path performs out-of-bounds writes for partial save-state reads", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "type": "CWE"}]}], "affected": [{"vendor": "TianoCore", "product": "EDK2", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "edk2-stable202608", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "EDK2 contains vulnerabilities in\nBIOS where skilled and privileged users or attackers may cause \u201cOut-of-bounds Write\u201d by local access. Successful exploitation of this vulnerability could compromise\nSMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>EDK2 contains vulnerabilities in\nBIOS where skilled and privileged users or attackers may cause \u201cOut-of-bounds Write\u201d by local access. Successful exploitation of this vulnerability could compromise\nSMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability.</p>"}]}], "references": [{"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-979r-6wfh-gq4h"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "20000419", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EDK2", "vendor": "TianoCore", "versions": [{"lessThanOrEqual": "edk2-stable202608", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "infosec@edk2.groups.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EDK2 contains vulnerabilities in\nBIOS where skilled and privileged users or attackers may cause \u201cOut-of-bounds Write\u201d by local access. Successful exploitation of this vulnerability could compromise\nSMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability."}], "id": "CVE-2026-14968", "lastModified": "2026-11-12T21:30:23.870", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "infosec@edk2.groups.io", "type": "Secondary"}]}, "published": "2026-11-10T19:21:14.630", "references": [{"source": "infosec@edk2.groups.io", "url": "https://github.com/tianocore/edk2/security/advisories/GHSA-979r-6wfh-gq4h"}], "sourceIdentifier": "infosec@edk2.groups.io", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "infosec@edk2.groups.io", "type": "Secondary"}]}

{}

{"created": "2026-11-12T01:45:22.120983+00:00", "updated": "2026-11-13T22:30:07.642937+00:00", "vendors": []}