Insyde UEFI CVE-2025-10451

Exploitation requires the attacker to already possess local, high-privilege (ring-0/kernel or administrator) access in order to invoke the vulnerable System Management Interrupt (SMI) handler on an Insyde-based UEFI device; there is no remote or network path (AV:L) and no user interaction is needed (UI:N). The specific condition is the ability to pass crafted input to the affected SMM handler, which performs an unchecked write to an output buffer (CWE-787), corrupting SMRAM. Limiting factors that reduce real-world risk: the PR:H requirement means the attacker must have already compromised the OS to kernel level, the flaw is firmware/platform-specific (only affected Insyde firmware versions on specific OEM devices), and no public exploit or active exploitation is known.

This is a genuine but high-barrier platform-firmware flaw (CWE-787 out-of-bounds write) in Insyde's UEFI implementation affecting System Management Mode (SMM), the most privileged x86 execution context. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.2) is internally consistent: local attack vector and high privileges required (an attacker must already hold ring-0/kernel-level access to reach the vulnerable SMI handler), but the scope change (S:C) plus full C/I/A impact correctly reflect that crossing into SMM breaks the platform's foundational trust boundary - code in SMM sits below the OS and hypervisor. Weighing the signals together, this is a privilege-escalation/persistence primitive, not a mass-exploitation threat: EPSS is very low at 0.15% (3rd percentile), it is NOT on the CISA KEV list, and no public PoC is referenced. The low EPSS is consistent with the high prerequisite (PR:H, local) rather than contradicting the severity. No SSVC fields were provided in the input. Prioritize this for firmware/supply-chain-sensitive fleets (where SMM compromise defeats Secure Boot, BitLocker, and attestation) but treat it as lower-urgency than any remote or PR:N issue for general patch cadence.

An attacker who has already achieved administrative/kernel-level code execution on the host invokes the affected System Management Interrupt (SMI) handler with crafted input, causing an unchecked write to an output buffer that corrupts SMRAM. This lets them execute arbitrary code in SMM, escalating from OS-level control to firmware-level control that survives OS reinstalls and bypasses Secure Boot. No public exploit is identified at time of analysis, and local high-privilege access is a prerequisite.