CVE-2026-66332: OOB-Read in FmpCapsuleUpdate

Published Nov 10, 2026

Updated

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Out-of-Bound Read” by local access. Successful exploitation of this vulnerability may lead to a denial of service during firmware update processing, such as a crash or failed update if the out-of-bounds read hits unmapped memory. It could also potentially impact Confidentiality and Availability.

Event History

Nov 10, 2026

CVE Published

via MITRE·04:21 PM

Data Sourced

via MITRE·04:21 PM

DescriptionWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems using the affected AMI APTIOV BIOS are exposed when a privileged local user can perform firmware update processing. The issue requires local access and privileged user capabilities.

What does an attacker need to exploit it?

An attacker needs privileged access on the local system and must be able to trigger the vulnerable firmware update path. The provided information does not indicate that remote or unprivileged exploitation is possible.

What is the likely operational impact?

Exploitation may cause a denial of service during firmware update processing, including a crash or failed update when the out-of-bounds read reaches unmapped memory. The advisory also identifies potential confidentiality and availability impact.

CVE-2026-66332: OOB-Read in FmpCapsuleUpdate

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What is the likely operational impact?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What is the likely operational impact?