AMI vulnerabilities
We track 51 vulnerabilities in AMI products across 7 products. 51 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 13, 2026.
Latest AMI vulnerabilities
- 8.3 High severity
AptioV: Buffer Access with Incorrect Length Value
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and al
- 7.1 High severity
AptioV: Out-of-bounds Write
AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidential
- 8.2 High severity
AptioV: Buffer Copy without Checking Size of Input
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confiden
- 7.1 High severity
AptioV: Integer Overflow or Wraparound
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact C
- 8.7 High severity
AptioV: Incomplete List of Disallowed Inputs
AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Inte
- 8.8 High severity
AptioV: Improper Handling of Insufficient Permissions or Privileges
APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access. Successful exploitation of this vulnerability can lead to escalation of authorization and potentially impact Integrity
- 7.8 High severity
AptioV: Improper Restriction of Operations within the Bounds of a Memory Buffer
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local means. Successful exploitation of this vulnerability may lead to memory corruption and impact Integrity and
- 7.3 High severity
AptioV: Out-of-bounds Write
APTIOV contains a vulnerability in BIOS where an attacker may cause a Buffer Copy without Checking Size of Input by local accessing. Successful exploitation of this vulnerability may lead to arbitrary code execution.
- 7.8 High severity
AptioV: Out-of-bounds Write
APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.
- 7.8 High severity
AptioV: Out-of-bounds Write
APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.
- 7.0 High severity
AptioV: Time-of-check Time-of-use (TOCTOU) Race Condition
APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.
- 9.8 Critical severity
AMI MegaRAC SPx Authentication Bypass by Spoofing Exploited
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 7.0 High severity
AptioV: Time-of-check Time-of-use (TOCTOU) Race Condition
APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.
- 8.8 High severity
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input…
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploitation of these vulnerabilities may lead to overwriting arbitrary memory and execute arbitrary code at SMM level, also im
- 7.8 High severity
AptioV: Time-of-check Time-of-use (TOCTOU) Race Condition
APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may lead to execution of arbitrary code on the target device.
- 8.8 High severity
AptioV: Improper Restriction of Operations within the Bounds of a Memory Buffer
APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of th
- 7.8 High severity
AptioV: Improper Restriction of Operations within the Bounds of a Memory Buffer
APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buffer by local. Successful exploitation of this vulnerability may lead to privilege escalation and potentially arbitrary co
- 7.1 High severity
AptioV: Improper Access Control
APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to unexpected SPI flash modifications and BIOS boot kit launches, also impacting the availability.
- 7.8 High severity
This SMM vulnerability affects certain modules, allowing privileged attackers to execute…
This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAM to kernel space, potentially leading to denial-of-service attacks.
- 7.8 High severity
AptioV: Improper Privilege Management
The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. This could lead to privilege escalation, arbitrary code execution, and bypassing OS security mechanisms
- 8.8 High severity
MegaRAC_SPx: Out-of-bounds Write
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 8.8 High severity
MegaRAC_SPx: Out-of-bounds Write
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 8.8 High severity
MegaRAC_SPx: Out-of-bounds Write
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 8.8 High severity
MegaRAC_SPx: Out-of-bounds Write
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 8.8 High severity
MegaRAC_SPx: Out-of-bounds Write
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 8.8 High severity
MegaRAC_SPx: Out-of-bounds Write
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 7.8 High severity
MegaRAC_SPx: Improper Restriction of Operations within the Bounds of a Memory Buffer
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 7.8 High severity
MegaRAC_SPx: Improper Restriction of Operations within the Bounds of a Memory Buffer
AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability.
- 7.8 High severity
AptioV: Unrestricted Upload of File with Dangerous Type
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.
- 7.8 High severity
AptioV: Unrestricted Upload of File with Dangerous Type
AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.
- 7.8 High severity
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input…
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
- 7.8 High severity
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input…
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
- 7.8 High severity
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input…
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
- 7.8 High severity
AptioV: Improper Access Control
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
- 8.8 High severity
MegaRAC_SPx12: Improper Control of Generation of Code
AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.
- 8.0 High severity
MegaRAC_SPx12: Authentication Bypass by Spoofing
AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.
- 8.8 High severity
MegaRAC_SPx: Use of Hard-coded Credentials
AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.
- 8.1 High severity
MegaRAC_SPx: Missing Cryptographic Step
AMI SPx contains a vulnerability in the BMC where a user may cause a missing cryptographic step by generating a hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to the loss confidentiality, integrity, and authe
- 9.8 Critical severity
MegaRAC_SPx: Use of Hard-coded Credentials
AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.
- 8.8 High severity
MegaRAC_SPx: Inadequate Encryption Strength
AMI SPx contains a vulnerability in the BMC where a user may cause an inadequate encryption strength by hash-based message authentication code (HMAC). A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability