CVE-2023-26299
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP...
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
- Record
CVE-2023-26299- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
CVE List No score
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
- Record
CVE-2023-26299- Updated
- 2026-11-02
EUVDEUVD-2023-30122
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
- Record
EUVD-2023-30122- CVSS
- 0.0 None
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hwjr-m4gg-39hg
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP...
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
- Record
GHSA-hwjr-m4gg-39hg- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
Affected products
- hp inc. pc products using ami uefi firmware
- hp 200 g3 firmware
- hp 200 g4 22 all-in-one firmware
- hp 200 pro g4 22 all-in-one firmware
- hp 205 g4 22 all-in-one firmware
- hp 205 pro g4 22 all-in-one firmware
- hp 240 g10 firmware
- hp 245 g6 firmware
- hp 245 g7 firmware
- hp 245 g8 firmware
- hp 247 g8 firmware
- hp 250 g10 firmware
Show 48 moreShow less
- hp 255 g10 firmware
- hp 260 g4 desktop mini firmware
- hp 280 g3 firmware
- hp 280 g4 firmware
- hp 280 g4 microtower firmware
- hp 280 g5 firmware
- hp 280 g5 small form factor firmware
- hp 280 g6 firmware
- hp 280 g8 microtower firmware
- hp 280 pro g3 firmware
- hp 280 pro g4 microtower firmware
- hp 280 pro g5 small form factor firmware
- hp 282 g5 firmware
- hp 282 g6 firmware
- hp 282 pro g4 microtower firmware
- hp 288 g5 firmware
- hp 288 g6 firmware
- hp 288 pro g4 microtower firmware
- hp 290 g1 firmware
- hp 290 g2 firmware
- hp 290 g2 microtower firmware
- hp 290 g3 firmware
- hp 290 g3 small form factor firmware
- hp 290 g4 firmware
- hp 349 g7 firmware
- hp 470 g10 firmware
- hp 470 g9 firmware
- hp desktop pro g1 microtower firmware
- hp pro small form factor 280 g9 desktop firmware
- hp pro small form factor 290 g9 desktop firmware
- hp pro small form factor zhan 66 g9 desktop firmware
- hp pro tower 200 g9 desktop firmware
- hp pro tower 280 g9 desktop firmware
- hp pro tower 290 g9 desktop firmware
- hp pro tower zhan 99 g9 desktop firmware
- hp proone 240 g10 firmware
- hp proone 240 g9 firmware
- hp proone 440 g3 firmware
- hp proone 490 g3 firmware
- hp proone 496 g3 firmware
- hp t430 firmware
- hp t628 firmware
- hp vr backpack g2 firmware
- hp z vr backpack g1 workstation firmware
- hp zhan 86 pro g2 microtower firmware
- hp zhan 99 g2 firmware
- hp zhan 99 g4 firmware
- hp zhan 99 pro g1 microtower firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-26299 is a high vulnerability (CVSS 7.0) in Hp Inc. Pc Products Using Ami Uefi Firmware, published June 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.