Slim Bootloader CVE-2026-20753

Exploitation requires local access to the platform (AV:L), pre-existing high privileges - a system-software adversary with a privileged user account (PR:H) - and a specific Attack Requirement to be satisfied (CVSS 4.0 AT:P), meaning a particular platform or firmware condition must be present for the overflow to be reachable; the exact condition is defined by Intel-SA-01425 and is not fully specified in the provided description. No user interaction is required (UI:N) and attack complexity is low (AC:L) once conditions are met. Limiting factors that reduce realistic risk: the attacker must already be privileged and local (no remote or unauthenticated path), the AT:P requirement means default/arbitrary configurations may not be exploitable, and only Intel platforms running Slim Bootloader firmware are affected.

The CVSS 4.0 base score is 8.7 (High) with vector AV:L/AC:L/AT:P/PR:H/UI:N and total impact (VC/VI/VA and SC/SI/SA all High). The signals are internally consistent toward a high-severity-but-hard-to-reach flaw: the impact is total, but the preconditions materially constrain real-world risk - the attacker must already hold high privileges (PR:H), have local access (AV:L), and a specific Attack Requirement must be met (AT:P). Corroborating this, EPSS is 0.01% (3rd percentile), SSVC reports Exploitation: none and Automatable: no, and there is no KEV listing and no known POC. In short, this is a genuinely serious firmware-integrity issue if reached, but it is not a mass-exploitation or wormable threat; it is a defense-in-depth / post-compromise concern rather than an internet-facing emergency. Note one caveat: SSVC rates Technical Impact as 'total' which aligns with the CVSS total-impact metrics, so there is no conflict, but the vendor advisory should be consulted to confirm the exact Attack Requirement (AT:P) since that condition governs realistic exploitability.

A local attacker who already holds high (administrative/system) privileges on an Intel platform running Slim Bootloader targets a boot-time firmware routine, supplying crafted input that triggers the integer overflow when a required condition is present. The resulting memory corruption lets the attacker execute code in the firmware trust domain, corrupting the boot chain and gaining persistent, high-impact control over the system. No public POC is currently known, and the attack cannot be launched remotely or without existing privileges.