EUVD-2025-21141
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control both the read and write addresses used by the CommandRcx1 function. The write target is derived from an unvalidated UEFI NVRAM variable (SetupXtuBufferAddress), while the write content is read from an attacker-controlled pointer based on the RBX register. This dual-pointer dereference enables arbitrary memory writes within System Management RAM (SMRAM), leading to potential SMM privilege escalation and firmware compromise.
Analysis
CVE-2025-7027 is a security vulnerability (CVSS 8.2) that allows a local attacker. High severity vulnerability requiring prompt remediation.
Technical Context
Vulnerability type not specified by vendor. CVSS 8.2 indicates high severity.
Affected Products
['Unspecified product']
Remediation
Monitor vendor channels for patch availability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today