Threats tagged 'ghsa-g4hc-h3h3-22rv'

CVE-2025-7028 is a local privilege escalation vulnerability in the Software SMI handler (SwSmiInputValue 0x20) that allows an attacker to supply a crafted pointer through CPU registers. This pointer is used unchecked in flash management functions, enabling arbitrary read/write access to System Management RAM (SMRAM). Exploitation can lead to firmware memory corruption, exfiltration of sensitive SMRAM content, or installation of persistent implants.