AMI AptioV EUVD-2025-211078

Requires local access to a system running AMI Aptio V (APTIOV) UEFI BIOS plus low-level privileges (PR:L) sufficient to reach the vulnerable firmware interface that mishandles a buffer length value (CWE-805); there is no network vector (AV:L) and no user interaction is needed (UI:N). Limiting factors for defenders: the attacker must already have local code execution or privileged OS-level access on the target, the flaw is not remotely exploitable, no public exploit exists, and remediation depends on the OEM/board vendor shipping the AMI firmware fix - meaning real-world exposure is highest on physically accessible, multi-tenant, or already-compromised hosts rather than internet-facing attack surface.

This is a credible but second-tier priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 8.3 (High), but the key downgrading signal is the LOCAL attack vector combined with required privileges (PR:L) - this is not remotely reachable. The input provides no EPSS score, the CVE is NOT in CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact profile is skewed: the vendor vector rates confidentiality and integrity as Low (VC:L/VI:L) but availability as High (VA:H), with subsequent-system availability also High (SA:H), indicating the primary realistic outcome is firmware/system availability loss and corruption rather than clean data theft - this slightly tempers the 'arbitrary code execution' language in the description. Firmware-level code execution is inherently high-value (pre-OS, persistence, defense evasion potential), which raises the ceiling, but the local-access precondition and absence of exploitation signals mean this is a patch-on-normal-cadence issue for most fleets rather than an emergency, with priority elevated only for high-assurance or physically exposed systems. Note a tension to verify: the description's 'arbitrary code execution' at BIOS level would typically justify higher C/I impact than the vendor's VC:L/VI:L - the limited detail in the advisory means exact exploit primitive should be confirmed with AMI.

A local, low-privileged attacker (or malware already running on the host) supplies a crafted input to a vulnerable AMI Aptio V BIOS interface whose length field is mishandled (CWE-805), triggering a buffer overflow and memory corruption in firmware context that can escalate to code execution below the OS. No public exploit code is referenced, and exploitation requires existing local access rather than a network entry point.