CVE-2025-62864
CriticalSummary
Ampere AmpereOne AC03 devices before 3.5.9.3, AC04 before 4.4.5.2, and M before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM MMCommunicate service that could result in an out-of-bounds write within the UEFI-MM Secure Partition context.
Risk Assessment
An attacker could exploit this vulnerability to compromise memory integrity in the Secure Partition, potentially leading to privilege escalation or system security breach.
Recommendation
Update the firmware of Ampere devices to versions containing fixes.
Original NVD description (English source)
Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM MMCommunicate service that could result in an out-of-bounds write within the UEFI-MM Secure Partition context.