CVE-2025-3052

An arbitrary write vulnerability in Microsoft signed UEFI firmware from DT Research Inc.

High · published June 10, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00422 · 35.5th percentile
Published
2025-06-10T19:19Z
EPSS history
Timeline
  • 10 JUN 19:19Z
    An arbitrary write vulnerability in Microsoft signed UEFI firmware from DT Research Inc.
    cvelistv5