CVE-2025-20064
HighSummary
Improper input validation in the UEFI FlashUcAcmSmm module for some Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a high complexity attack may enable local code execution. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high.
Risk Assessment
An attacker can execute arbitrary code with elevated privileges, leading to full compromise of the system and data.
Recommendation
Apply UEFI firmware patches provided by the manufacturer. Restrict local access and implement system integrity monitoring.
Other vulnerabilities in Intel UEFI firmware
See all- CVE-2025-20105High
Improper input validation in some UEFI firmware SMM module for Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a low complexity attack may enable local code execution. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high.
- CVE-2025-20068High
Improper input validation in the UEFI ImcErrorHandler module for some Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high, but subsequent impacts are none.
- CVE-2026-20712Medium
Some UEFI firmware for Intel(R) reference platforms contains an incomplete cleanup vulnerability that may allow information disclosure. A system software adversary with a privileged user and a low complexity attack may enable data exposure. This requires local access but no user interaction. The vulnerability may impact system confidentiality (high), but not integrity or availability.
Original NVD description (English source)
Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.