There is a stack buffer overflow vulnerability, which could lead to arbitrary code…
Priority HIGH 69CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version <= P13 (latest) and AP130 F2 firmware version <= P04 (latest) and Aspire 1600X firmware version <= P11.A3L (latest) and Aspire 1602M firmware version <= P11.A3L (latest) and Aspire 7600U firmware version <= P11.A4 (latest) and Aspire MC605 firmware version <= P11.A4L (latest) and Aspire TC-105 firmware version <= P12.B0L (latest) and Aspire TC-120 firmware version <= P11-A4 (latest) and Aspire U5-620 firmware version <= P11.A1 (latest) and Aspire X1935 firmware version <= P11.A3L (latest) and Aspire X3475 firmware version <= P11.A3L (latest) and Aspire X3995 firmware version <= P11.A3L (latest) and Aspire XC100 firmware version <= P11.B3 (latest) and Aspire XC600 firmware version <= P11.A4 (latest) and Aspire Z3-615 firmware version <= P11.A2L (latest) and Veriton E430G firmware version <= P21.A1 (latest) and Veriton B630_49 firmware version <= AAP02SR (latest) and Veriton E430 firmware version <= P11.A4 (latest) and Veriton M2110G firmware version <= P21.A3 (latest) and Veriton M2120G fir.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 68
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:acer:altos_t110_f3_firmware:*:*:*:*:*:*:*:* | before p13 | Vulnerable | Acer |
| cpe:2.3:h:acer:altos_t110_f3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:ap130_f2_firmware:*:*:*:*:*:*:*:* | before p04 | Vulnerable | Acer |
| cpe:2.3:h:acer:ap130_f2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_1600x_firmware:*:*:*:*:*:*:*:* | before p11.a3l | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_1600x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_1602m_firmware:*:*:*:*:*:*:*:* | before p11.a3l | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_1602m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_7600u_firmware:*:*:*:*:*:*:*:* | before p11.a4 | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_7600u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
- cpe:2.3:o:acer:altos_t110_f3_firmware:*:*:*:*:*:*:*:* Versions before p13 Vulnerable ·Acer
- cpe:2.3:h:acer:altos_t110_f3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:ap130_f2_firmware:*:*:*:*:*:*:*:* Versions before p04 Vulnerable ·Acer
- cpe:2.3:h:acer:ap130_f2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_1600x_firmware:*:*:*:*:*:*:*:* Versions before p11.a3l Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_1600x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_1602m_firmware:*:*:*:*:*:*:*:* Versions before p11.a3l Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_1602m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_7600u_firmware:*:*:*:*:*:*:*:* Versions before p11.a4 Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_7600u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
Show 58 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:acer:aspire_mc605_firmware:*:*:*:*:*:*:*:* | before p11.a4l | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_mc605:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_tc-105_firmware:*:*:*:*:*:*:*:* | before p12.b0l | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_tc-105:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_tc-120_firmware:*:*:*:*:*:*:*:* | before p11-a4 | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_tc-120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_u5-620_firmware:*:*:*:*:*:*:*:* | before p11.a1 | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_u5-620:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_x1935_firmware:*:*:*:*:*:*:*:* | before p11.a3l | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_x1935:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_x3475_firmware:*:*:*:*:*:*:*:* | before p11.a3l | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_x3475:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_x3995_firmware:*:*:*:*:*:*:*:* | before p11.a3l | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_x3995:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_xc100_firmware:*:*:*:*:*:*:*:* | before p11.b3 | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_xc100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_xc600_firmware:*:*:*:*:*:*:*:* | before p11.a4 | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_xc600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:aspire_z3-615_firmware:*:*:*:*:*:*:*:* | before p11.a2l | Vulnerable | Acer |
| cpe:2.3:h:acer:aspire_z3-615:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_b630_49_firmware:*:*:*:*:*:*:*:* | before aap02sr | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_b630_49:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_e430g_firmware:*:*:*:*:*:*:*:* | before p21.a1 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_e430g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_e430_firmware:*:*:*:*:*:*:*:* | before p11.a4 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_e430:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_m2110g_firmware:*:*:*:*:*:*:*:* | before p21.a3 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_m2110g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_m2120g_firmware:*:*:*:*:*:*:*:* | before p11-a3 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_m2120g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_m2611g_firmware:*:*:*:*:*:*:*:* | before p11-b0l | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_m2611g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_m2611_firmware:*:*:*:*:*:*:*:* | before p11.b0 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_m2611:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_m4620_firmware:*:*:*:*:*:*:*:* | before p21.a3 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_m4620:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_m4620g_firmware:*:*:*:*:*:*:*:* | before p21.a3 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_m4620g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_m6620g_firmware:*:*:*:*:*:*:*:* | before p21.a0 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_m6620g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_n2620g_firmware:*:*:*:*:*:*:*:* | before p21.b0 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_n2620g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_n4620g_firmware:*:*:*:*:*:*:*:* | before p11.a2l | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_n4620g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_n4630g_firmware:*:*:*:*:*:*:*:* | before p21.b0 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_n4630g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_s6620g_firmware:*:*:*:*:*:*:*:* | before p11.a1 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_s6620g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_x2611g_firmware:*:*:*:*:*:*:*:* | before p11.a4 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_x2611g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_x2611_firmware:*:*:*:*:*:*:*:* | before p11.a4 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_x2611:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_x4620g_firmware:*:*:*:*:*:*:*:* | before p11.a3 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_x4620g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_x6620g_firmware:*:*:*:*:*:*:*:* | before p11.a3 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_x6620g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
| cpe:2.3:o:acer:veriton_z2650g_firmware:*:*:*:*:*:*:*:* | before p21.a1 | Vulnerable | Acer |
| cpe:2.3:h:acer:veriton_z2650g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Acer |
- cpe:2.3:o:acer:aspire_mc605_firmware:*:*:*:*:*:*:*:* Versions before p11.a4l Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_mc605:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_tc-105_firmware:*:*:*:*:*:*:*:* Versions before p12.b0l Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_tc-105:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_tc-120_firmware:*:*:*:*:*:*:*:* Versions before p11-a4 Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_tc-120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_u5-620_firmware:*:*:*:*:*:*:*:* Versions before p11.a1 Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_u5-620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_x1935_firmware:*:*:*:*:*:*:*:* Versions before p11.a3l Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_x1935:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_x3475_firmware:*:*:*:*:*:*:*:* Versions before p11.a3l Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_x3475:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_x3995_firmware:*:*:*:*:*:*:*:* Versions before p11.a3l Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_x3995:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_xc100_firmware:*:*:*:*:*:*:*:* Versions before p11.b3 Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_xc100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_xc600_firmware:*:*:*:*:*:*:*:* Versions before p11.a4 Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_xc600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:aspire_z3-615_firmware:*:*:*:*:*:*:*:* Versions before p11.a2l Vulnerable ·Acer
- cpe:2.3:h:acer:aspire_z3-615:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_b630_49_firmware:*:*:*:*:*:*:*:* Versions before aap02sr Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_b630_49:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_e430g_firmware:*:*:*:*:*:*:*:* Versions before p21.a1 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_e430g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_e430_firmware:*:*:*:*:*:*:*:* Versions before p11.a4 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_e430:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_m2110g_firmware:*:*:*:*:*:*:*:* Versions before p21.a3 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_m2110g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_m2120g_firmware:*:*:*:*:*:*:*:* Versions before p11-a3 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_m2120g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_m2611g_firmware:*:*:*:*:*:*:*:* Versions before p11-b0l Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_m2611g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_m2611_firmware:*:*:*:*:*:*:*:* Versions before p11.b0 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_m2611:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_m4620_firmware:*:*:*:*:*:*:*:* Versions before p21.a3 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_m4620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_m4620g_firmware:*:*:*:*:*:*:*:* Versions before p21.a3 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_m4620g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_m6620g_firmware:*:*:*:*:*:*:*:* Versions before p21.a0 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_m6620g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_n2620g_firmware:*:*:*:*:*:*:*:* Versions before p21.b0 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_n2620g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_n4620g_firmware:*:*:*:*:*:*:*:* Versions before p11.a2l Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_n4620g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_n4630g_firmware:*:*:*:*:*:*:*:* Versions before p21.b0 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_n4630g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_s6620g_firmware:*:*:*:*:*:*:*:* Versions before p11.a1 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_s6620g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_x2611g_firmware:*:*:*:*:*:*:*:* Versions before p11.a4 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_x2611g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_x2611_firmware:*:*:*:*:*:*:*:* Versions before p11.a4 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_x2611:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_x4620g_firmware:*:*:*:*:*:*:*:* Versions before p11.a3 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_x4620g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_x6620g_firmware:*:*:*:*:*:*:*:* Versions before p11.a3 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_x6620g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
- cpe:2.3:o:acer:veriton_z2650g_firmware:*:*:*:*:*:*:*:* Versions before p21.a1 Vulnerable ·Acer
- cpe:2.3:h:acer:veriton_z2650g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Acer
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-30426
- 2026-10-03 Alias added: GHSA-gj8c-59qc-mfr6
References
Sources
- CVE-2022-30426 · CVE Program
- CVE-2022-30426 · NVD
- FIRST EPSS
- GHSA-gj8c-59qc-mfr6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences