AMI Aptio V CVE-2025-58772

Requires local access to the system and low-level privileges (CVSS PR:L) - i.e., an authenticated local user or code already executing on the host that can reach the affected AMI Aptio V BIOS code path and deliver crafted input to trigger the classic buffer overflow (CWE-120); no user interaction and no special attack requirements are needed (UI:N/AT:N) and attack complexity is low (AC:L). The provided data does not name the exact vulnerable feature, interface, or configuration (CPE is wildcarded and the advisory content was not retrieved), so the specific trigger surface (e.g., SMM handler, NVRAM/UEFI variable, or setup routine) should be confirmed from AMI-SA-2026002. Limiting factors that reduce real-world risk: exploitation is strictly local (no network vector), requires existing privileges rather than anonymous access, and is confined to systems running affected Aptio V firmware versions.

Signals are moderately consistent and point to a serious-but-not-emergency local firmware flaw. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 8.2 (High) and tells us exploitation is local with low attack complexity, no attack requirements, no user interaction, but requires low-level privileges (PR:L) - i.e., an already-authenticated local user, not a remote unauthenticated attacker. Impact is skewed toward availability/integrity of the platform: VC:L/VI:L/VA:H with subsequent-system SA:H, meaning the primary damage is a high availability hit and cascading impact to a downstream system (consistent with corrupting firmware/SMM and bricking or destabilizing the platform) rather than mass data theft. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. EPSS was not provided; absence of an EPSS score plus the local-only vector argues against opportunistic internet-scale exploitation. The 'RCE' tag and the description's 'arbitrary code execution' claim are notable - code execution at BIOS/SMM privilege is high-impact and can undermine OS-level security boundaries - but the local, authenticated prerequisite sharply limits real-world reachability. Net: a real priority for high-assurance/physical-access-sensitive environments (where firmware integrity matters) and for standard patch cycles, but not a drop-everything remote threat. Note the tension between the 'RCE' tag/arbitrary-code-execution language and the vendor's modest VC:L/VI:L confidentiality/integrity scoring - verify exact impact with the AMI advisory.

A low-privileged local user (or malware already running on the host) supplies crafted input to a vulnerable AMI Aptio V BIOS code path, overflowing a fixed-length buffer (CWE-120) and corrupting adjacent memory. By controlling the overflow the attacker achieves arbitrary code execution in the firmware/SMM context, escalating beyond OS protections to compromise platform availability and integrity. No public proof-of-concept is identified at time of analysis, and the low attack complexity means a reliable exploit is plausible once the vulnerable handler is identified.