Threats tagged 'ghsa-9237-5j3g-vhw4'

CVE-2025-7027 is a high-severity vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) that allows a local attacker with high privileges to perform arbitrary memory writes within System Management RAM (SMRAM). This occurs because the write target address is derived from an unvalidated UEFI NVRAM variable, and the write content is controlled via a pointer based on the RBX register. Exploitation could lead to System Management Mode (SMM) privilege escalation and firmware compromise.