CVE-2025-20105
HighSummary
Improper input validation in some UEFI firmware SMM module for Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a low complexity attack may enable local code execution. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high.
Risk Assessment
An attacker can gain elevated privileges and take control of the system, leading to full compromise of confidentiality, integrity, and availability.
Recommendation
Apply UEFI firmware patches provided by the platform manufacturer. Restrict local access to the system to trusted users only.
Other vulnerabilities in Intel UEFI firmware
See all- CVE-2025-20068High
Improper input validation in the UEFI ImcErrorHandler module for some Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high, but subsequent impacts are none.
- CVE-2025-20064High
Improper input validation in the UEFI FlashUcAcmSmm module for some Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a high complexity attack may enable local code execution. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high.
- CVE-2026-20712Medium
Some UEFI firmware for Intel(R) reference platforms contains an incomplete cleanup vulnerability that may allow information disclosure. A system software adversary with a privileged user and a low complexity attack may enable data exposure. This requires local access but no user interaction. The vulnerability may impact system confidentiality (high), but not integrity or availability.
Original NVD description (English source)
Improper input validation in some UEFI firmware SMM module for the Intel(R) reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.