CVE-2024-36343
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Improper input validation in SMM communications buffer could allow a privileged attacker to perform out-of-bounds read/write in TSEG memory, potentially compromising confidentiality or integrity.
Risk Assessment
A privileged attacker could access sensitive data or modify critical system structures, leading to privilege escalation or system crash.
Recommendation
Apply patches from the motherboard or BIOS/UEFI vendor and restrict access to SMM interfaces.
Other vulnerabilities in System Management Mode
See all- CVE-2026-10589Medium
A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode.
- CVE-2026-10588Medium
A vulnerability allows a local privileged attacker to disclose the address of protected System Management Mode (SMM) memory.
- CVE-2026-10587Medium
A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Management Mode.
Original NVD description (English source)
Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited section of the Top of Memory Segment (TSEG) memory region, potentially resulting in loss of confidentiality or integrity.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS