High severity · published Jul 11, 2025
CVE-2025-7028
SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock Pointer
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo) that dereference both the structure and its nested members, such as BufAddr. This enables arbitrary read/write access to System Management RAM (SMRAM), allowing an attacker to corrupt firmware memory, exfiltrate SMRAM content via flash, or install persistent implants.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
UEFI-SmiFlash · GIGABYTE
1.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7028
kb.cert.org
https://kb.cert.org/vuls/id/746790
www.binarly.io
https://www.binarly.io/advisories/brly-dva-2025-010
www.gigabyte.com
https://www.gigabyte.com/Support/Security
www.kb.cert.org
https://www.kb.cert.org/vuls/id/746790