CVE-2025-7028

SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock Pointer

High · published July 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo) that dereference both the structure and its nested members, such as BufAddr. This enables arbitrary read/write access to System Management RAM (SMRAM), allowing an attacker to corrupt firmware memory, exfiltrate SMRAM content via flash, or install persistent implants.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.0th percentile
Published
2025-07-11T15:26Z
EPSS history
Timeline
  • 11 JUL 15:26Z
    SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock Pointer
    cvelistv5