Intel Slim Bootloader CVE-2026-25194

Exploitation requires all of the following simultaneously: (1) local access to the target system - the CVSS 4.0 AV:L metric confirms no remote exploitation path exists; (2) a high-privilege user account (PR:H per CVSS 4.0), meaning standard unprivileged or low-privileged user accounts cannot trigger the vulnerability; (3) specific attack requirements (AT:P) must be satisfied - the precise firmware state, configuration, or trigger input needed is not detailed in available descriptions beyond the AT:P designation, which confirms these conditions differ from a generic default-state attack. The impact is bounded exclusively to denial of service (VA:L); no confidentiality or integrity exploitation is possible per VC:N/VI:N. Remote, unauthenticated, and low-privilege exploitation are all ruled out by the confirmed CVSS 4.0 metrics.

The aggregate risk profile for this vulnerability is minimal across all available signal categories. The CVSS 4.0 score of 1.8 is internally consistent and appropriate: local-only attack vector, high-privilege prerequisite, specific attack requirements (AT:P), and an impact ceiling of low availability denial of service with no confidentiality or integrity exposure whatsoever. EPSS data was not provided in the available intelligence, but given the narrow local-access-plus-high-privilege attack surface and the absence of any public exploit code, real-world exploitation probability is expected to be very low - even a mid-sized municipal IT team in malbork managing Intel-based embedded infrastructure should treat this as a routine firmware maintenance item rather than an emergency response. The vulnerability is absent from the CISA KEV catalog, and no POC code has been identified. Under the SSVC decision framework, this would classify as 'Defer' given no active exploitation evidence, no feasibility of automated mass exploitation (local + PR:H constraints prevent it), and limited technical impact. The primary realistic threat is a privileged insider or a post-compromise attacker with elevated credentials deliberately crashing an embedded system for disruptive purposes.

A threat actor who has already obtained a high-privilege account on a system running vulnerable Intel Slim Bootloader firmware - through credential theft, insider abuse, or prior host compromise - satisfies the specific firmware attack preconditions and triggers the out-of-bounds write, causing the target system to become unavailable. No public exploit code has been identified, making opportunistic or automated exploitation implausible. This scenario is realistically limited to targeted insider threats or post-compromise situations where system disruption is a deliberate objective.