AMI Aptio V EUVD-2025-211077

Exploitation requires LOCAL access to a system running AMI Aptio V (APTIOV) BIOS AND pre-existing HIGH privileges (PR:H - e.g. administrator/kernel-level code execution), with no user interaction (UI:N). The out-of-bounds write is in BIOS code and affects the default firmware (no special feature toggle is cited in the advisory text). Key LIMITING factors: the HIGH attack complexity (AC:H) implies the attacker must meet specific state/timing or configuration preconditions to control the write, and the requirement for prior privileged local access means this cannot be reached by a remote or unauthenticated attacker - it is a privilege-escalation/firmware-persistence primitive rather than an initial-access vulnerability.

This is a genuine but constrained firmware-level risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:L/AC:H/PR:H/UI:N, base 7.1 High) is the dominant signal and it points away from easy exploitation: an attacker needs LOCAL access (AV:L), already-HIGH privileges (PR:H), and must overcome HIGH attack complexity (AC:H). Against that, the vulnerable-system impact is severe across all three pillars (VC:H/VI:H/VA:H) with limited subsequent-system impact (SC:L/SI:L/SA:L), which is consistent with an out-of-bounds write (CWE-787) in BIOS/UEFI that can yield memory corruption and arbitrary code execution at the firmware/SMM level. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis. The combination of high required privileges, local-only vector, and high complexity means this is a targeted/post-compromise privilege-and-persistence concern (firmware foothold) rather than a widely automatable attack - real priority for high-security and OEM supply-chain contexts, lower immediate urgency for general fleets. Note the input CVSS is 4.0 only; no CVSS 3.1 vector or EPSS was supplied, so exploitation-probability signals are missing and cannot corroborate or contradict the vector.

A local attacker who has already gained privileged (administrator/kernel-level) code execution on a system running AMI Aptio V firmware triggers a crafted condition that causes an out-of-bounds write in BIOS code, corrupting memory to execute arbitrary code at the firmware/SMM level. Because attack complexity is high, the attacker must satisfy specific timing or state preconditions to reliably control the write. No public exploit code was identified in the provided intelligence.