CVE-2026-20712
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Some UEFI firmware for Intel(R) reference platforms contains an incomplete cleanup vulnerability that may allow information disclosure. A system software adversary with a privileged user and a low complexity attack may enable data exposure. This requires local access but no user interaction. The vulnerability may impact system confidentiality (high), but not integrity or availability.
Risk Assessment
A local attacker with privileged access can access sensitive data stored in UEFI, potentially leading to confidentiality breaches.
Recommendation
Apply UEFI firmware updates provided by Intel for affected platforms.
Original NVD description (English source)
Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.