AMI vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited AMI flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2024-54085 AMI MegaRAC SPx Authentication Bypass by SpoofingExploited since Jun 25, 2025 · CVSS 10

Latest high and critical flaws

• CVE-2025-58774 AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access.High 8.3 · Oct 13, 2026
• CVE-2025-58773 AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write” by local access.High 7.1 · Oct 13, 2026
• CVE-2025-58772 AMI APTIOV contains vulnerabilities in BIOS where users may cause  “Classic Buffer Overflow” by local access.High 8.2 · Oct 13, 2026
• CVE-2025-58771 AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access.High 7.1 · Oct 13, 2026
• CVE-2026-33197 AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access.High 8.7 · Sep 8, 2026
• CVE-2025-58770 APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access.High 7.2 · Dec 12, 2025
• CVE-2025-33045 APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Information to an UnauthorHigh 8.2 · Sep 9, 2025
• CVE-2025-22830 APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access.High 7.3 · Aug 12, 2025
• CVE-2024-42446 APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means.High 7.5 · May 13, 2025
• CVE-2024-54085 AMI MegaRAC SPx Authentication Bypass by SpoofingExploited · Critical 10 · Mar 11, 2025
• CVE-2024-54084 APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means.High 7.5 · Mar 11, 2025
• CVE-2024-42444 APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means.High 7.5 · Jan 14, 2025
• CVE-2024-42442 APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over tHigh 7.2 · Nov 12, 2024
• CVE-2024-33657 This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak information from SMRAHigh 7.8 · Aug 21, 2024
• CVE-2024-33656 The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory.High 7.8 · Aug 21, 2024
• CVE-2023-3043 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network.Critical 9.6 · Jan 9, 2024
• CVE-2023-37297 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network.High 8.3 · Jan 9, 2024
• CVE-2023-37296 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack memory corruption via an adjacent network.High 8.3 · Jan 9, 2024
• CVE-2023-37295 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network.High 8.3 · Jan 9, 2024
• CVE-2023-37294 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a heap memory corruption via an adjacent network.High 8.3 · Jan 9, 2024
• CVE-2023-37293 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause a stack-based buffer overflow via an adjacent network.Critical 9.6 · Jan 9, 2024
• CVE-2023-34333 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference via a local network.High 7.8 · Jan 9, 2024
• CVE-2023-34332 AMI’s SPx contains a vulnerability in the BMC where an Attacker may cause an untrusted pointer to dereference by a local network.High 7.8 · Jan 9, 2024
• CVE-2023-39539 AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a PNG Logo file with dangerous type by Local access.High 7.5 · Dec 6, 2023
• CVE-2023-39538 AMI AptioV contains a vulnerability in BIOS where a User may cause an unrestricted upload of a BMP Logo file with dangerous type by Local access.High 7.5 · Dec 6, 2023