CVE-2022-26860

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-06 · updated 2026-06-17
Weakness: CWE-121

Description

Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security checks resulting in arbitrary code execution in SMM.

Affected products

Dell Alienware M15 R6 Firmware: before 1.8.0 — fixed in 1.8.0
Dell Chengming 3980 Firmware: before 2.21.0 — fixed in 2.21.0
Dell Chengming 3988 Firmware: before 1.9.0 — fixed in 1.9.0
Dell Chengming 3990 Firmware: before 1.8.2 — fixed in 1.8.2
Dell Chengming 3991 Firmware: before 1.8.2 — fixed in 1.8.2
Dell Edge Gateway 3000 Firmware: before 1.8.0 — fixed in 1.8.0
Dell Edge Gateway 5000 Firmware: before 1.18.0 — fixed in 1.18.0
Dell Embedded Box PC 3000 , CPG BIOS: before 1.14.0 — fixed in 1.14.0
Dell Embedded Box Pc 5000 Firmware: before 1.15.0 — fixed in 1.15.0
Dell G15 5510 Firmware: before 1.8.0 — fixed in 1.8.0
Dell G15 5511 Firmware: before 1.9.0 — fixed in 1.9.0
Dell G3 15 3590 Firmware: before 1.16.0 — fixed in 1.16.0
Dell G3 3500 Firmware: before 1.12.0 — fixed in 1.12.0
Dell G3 3579 Firmware: before 1.19.0 — fixed in 1.19.0
Dell G5 15 5587 Firmware: before 1.19.0 — fixed in 1.19.0
Dell G5 15 5590 Firmware: before 1.18.0 — fixed in 1.18.0
Dell G5 5000 Firmware: before 1.5.1 — fixed in 1.5.1
Dell G5 5090 Firmware: before 1.12.0 — fixed in 1.12.0
Dell G5 5500 Firmware: before 1.12.0 — fixed in 1.12.0
Dell G7 17 7700 Firmware: before 1.12.0 — fixed in 1.12.0
Dell G7 17 7790 Firmware: before 1.18.0 — fixed in 1.18.0
Dell G7 7500 Firmware: before 1.12.0 — fixed in 1.12.0
Dell G7 7588 Firmware: before 1.19.0 — fixed in 1.19.0
Dell Inspiron 13 5378 Firmware: before 1.36.0 — fixed in 1.36.0
Dell Inspiron 13 5379 Firmware: before 1.19.0 — fixed in 1.19.0
Dell Inspiron 13 7378 Firmware: before 1.36.0 — fixed in 1.36.0
Dell Inspiron 14 3467 Firmware: before 2.18.0 — fixed in 2.18.0
Dell Inspiron 14 3476 Firmware: before 1.16.0 — fixed in 1.16.0
Dell Inspiron 15 3567 Firmware: before 2.18.0 — fixed in 2.18.0
Dell Inspiron 15 5566 Firmware: before 1.17.0 — fixed in 1.17.0

How to fix

Upgrade to a fixed version: Dell Alienware M15 R6 Firmware 1.8.0; Dell Chengming 3980 Firmware 2.21.0; Dell Chengming 3988 Firmware 1.9.0; Dell Chengming 3990 Firmware 1.8.2; Dell Chengming 3991 Firmware 1.8.2; Dell Edge Gateway 3000 Firmware 1.8.0; Dell Edge Gateway 5000 Firmware 1.18.0; Dell Embedded Box PC 3000 , CPG BIOS 1.14.0; Dell Embedded Box Pc 5000 Firmware 1.15.0; Dell G15 5510 Firmware 1.8.0; Dell G15 5511 Firmware 1.9.0; Dell G3 15 3590 Firmware 1.16.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-26860 or the next vulnerability affects your stack