AMI Aptio V CVE-2025-22833

Exploitation requires local access to a system running AMI Aptio V BIOS plus existing low-level privileges (PR:L), and is further gated by a specific attack requirement (AT:P in the CVSS 4.0 vector) and passive user interaction (UI:P) - it is not remotely reachable and not exploitable by a fully unauthenticated attacker. The limiting factors are therefore substantial: the attacker must already be on the host with some privilege, and the required local/firmware-interaction conditions make opportunistic mass exploitation impractical, confining realistic risk to targeted attacks on specific high-value or physically accessible machines. The exact vulnerable BIOS feature/handler is not named in the provided description beyond the unchecked buffer copy.

This is a genuinely moderate, not high, priority issue - the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P) describes a local attack that requires existing low-level privileges on the machine, passive user interaction, and a specific present attack requirement (AT:P), which is why the base score lands at only 4.6 despite a high integrity/availability impact (VI:H/VA:H) from arbitrary code execution in BIOS. Confidence in low real-world urgency is reinforced by the EPSS score of 0.16% (5th percentile), indicating negligible modeled exploitation probability. There is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active exploitation. The one point worth flagging: firmware/BIOS flaws carry outsized consequence when exploited (persistence below the OS, bypass of OS-level defenses), so while the probability is low, a successful exploit on a targeted high-value host is severe - this is a patch-in-normal-cycle item for most fleets but should be prioritized on sensitive or physically-exposed systems. The confidentiality impact is only Low (VC:L), consistent with a code-execution-in-firmware outcome rather than mass data theft.

A local attacker who already has low-privileged code execution on a machine running AMI Aptio V BIOS supplies oversized input to a vulnerable BIOS routine that copies a buffer without validating its size, triggering an out-of-bounds write (CWE-787). With the passive user interaction and attack condition satisfied, the overflow is leveraged to execute arbitrary code in the firmware context. No public exploit code has been identified at time of analysis.