CVE-2025-7028

SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock Pointer

CVSS 7.8 HIGHEPSS 0.2%

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Jul 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo) that dereference both the structure and its nested members, such as BufAddr. This enables arbitrary read/write access to System Management RAM (SMRAM), allowing an attacker to corrupt firmware memory, exfiltrate SMRAM content via flash, or install persistent implants.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

GIGABYTE · UEFI-SmiFlash

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://kb.cert.org/vuls/id/746790 https://www.binarly.io/advisories/brly-dva-2025-010 https://www.gigabyte.com/Support/Security https://www.kb.cert.org/vuls/id/746790