Read the docs
TI-2022-10117 Aliases CVE-2022-26873GHSA-8vmj-6582-mgcq

Stack-based buffer overflow in AMI Aptio

Priority HIGH 69CWE-121Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00418 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMIAptio5.x—No fix listedCNA
  • Aptio VendorAMI Affected 5.x Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc510_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc510:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc710_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableIntel
cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc710:-:*:*:*:*:*:*:*not specified by NVDRunning onIntel
cpe:2.3:o:ami:aptio_v:5.0:*:*:*:*:*:*:*5.0VulnerableAMI
  • cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc510_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc710_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Intel
  • cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
  • cpe:2.3:o:ami:aptio_v:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·AMI

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26873
  2. 2026-10-03 Alias added: GHSA-8vmj-6582-mgcq

References

Exploit 1

Advisory 2

  • TI-2022-19108 The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase. CVSS 3.1HIGH 8.2
  • TI-2022-19103 Stack overflow vulnerability in SMI handler on SmmSmbiosElog. CVSS 3.1HIGH 8.8
  • TI-2022-19107 SMM memory corruption vulnerability in OverClockSmiHandler SMM driver CVSS 3.1HIGH 8.2
  • TI-2024-28413 Runtime Service Access outside SMRAM CVSS 3.1HIGH 8.8
  • TI-2025-24038 Legacy Serial Redirection SMRAM Vulnerabilities CVSS 3.1HIGH 8.2
  • TI-2023-20671 Failure when uploading a Logo image file CVSS 3.1HIGH 7.8
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences