Vulnerability-Lookup

BDU:2025-09304 (CVE-2025-7026)

Vulnerability from fstec – Published: 2025-08-01 – Updated: 2025-08-01 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость функции SwSmiInputValue() обработчика System Management Interrupt (SMI) микропрограммного обеспечения материнских плат Gigabyte, позволяющая нарушителю обойти ограничения безопасности, повысить свои привилегии и выполнить произвольный код

Summary

Уязвимость функции SwSmiInputValue() обработчика System Management Interrupt (SMI) микропрограммного обеспечения материнских плат Gigabyte связана с разыменованием недоверенного указателя. Эксплуатация уязвимости может позволить нарушителю обойти ограничения безопасности, повысить свои привилегии и выполнить произвольный код

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

8.2 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-822 - Ненадежное разыменование указателя

Aliases

CVE-2025-7026

References

3 references

URL
https://www.gigabyte.com/Support/Security/2302
https://vuldb.com/?id.316178
https://www.binarly.io/advisories/brly-dva-2025-008

Impacted products

77 products from 2 vendors

Vendors

Gigabyte Technology Co., Ltd.

Products

GA-H110M-S2HP, Z590 GAMING X, H510M S2H V2, H510M S2H, GA-H110M-S2V, GA-H110M-S2H, H410M S2H V2 (rev. 1.9/2.1), H410M H V2 (rev. 1.9), GA-B150M-DS3H DDR3, GA-H110M-S2V DDR3, GA-H110M-S2 DDR3, H510M DS2, G1.Sniper M7, GA-B150-HD3P, GA-H110M-DS2 DDR3, Z390 AORUS PRO WIFI, Z390 AORUS PRO, Z490 AORUS MASTER, GA-H310TN-CM, H310M D3H, Z390 AORUS XTREME WATERFORCE, B360M D2V, B360M H, B360M GAMING HD, GA-H110M-D3H, GA-H110M-D3H R2 TPM, GA-H110M-D3H R2, B360 AORUS GAMING 3, B360 AORUS GAMING 3 WIFI, GA-B150-HD3 DDR3, H310M S2H, H310M DS2V, Z490 GAMING X AX, Z490 GAMING X, Z490 AORUS MASTER WATERFORCE, B460M H, B460M GAMING HD, GA-H110-D3A, B560 HD3, B460M DS3H AC, B460M AORUS PRO, H510M S2, B560M H V2, H510M DS2V, H510M H, Z490I AORUS ULTRA, GA-B150M-Gaming, B360 HD3P, GA-H110M-DS2 (rev. 1.0/1.1/1.2), H470M K, H410M K, H510M K V2, H510M S2H V3, H410M H V2, H410M S2 V2, H510M H V2, H510M S2 V2, H470M H, Z590 AORUS MASTER, GA-H110M-DS2V DDR3, GA-B150M-DS3H, Z390 AORUS XTREME, H410M S2H V3, H410M DS2V V3, H410M S2 V3, H410M H V3, GA-H110M-DS2, GA-B150M-D2V, Z490 VISION D, C621 AORUS XTREME, GA-H110TN-E, B360M DS3H, H410M S2H V2, H410M DS2V V2, H510M K, Z590 AORUS ELITE AX, Z590 AORUS ELITE

Versions

F22f (2024-07-31) (GA-H110M-S2HP), F10 (2023-12-19) (Z590 GAMING X), F13 (2023-12-19) (H510M S2H V2), F17 (2023-12-19) (H510M S2H), F26a (2024-07-31) (GA-H110M-S2V), F26g (2024-07-31) (GA-H110M-S2H), FA (2024-07-03) (H410M S2H V2 (rev. 1.9/2.1)), FA (2024-07-09) (H410M H V2 (rev. 1.9)), F21f (2024-07-31) (GA-B150M-DS3H DDR3), F21e (2024-07-31) (GA-H110M-S2V DDR3), F20g (2024-07-31) (GA-H110M-S2 DDR3), F15 (2023-12-19) (H510M DS2), F20h (2024-07-31) (G1.Sniper M7), F24h (2024-07-31) (GA-B150-HD3P), F20g (2024-07-31) (GA-H110M-DS2 DDR3), F13 (2024-01-11) (Z390 AORUS PRO WIFI), F13 (2024-01-11) (Z390 AORUS PRO), F23 (2023-12-20) (Z490 AORUS MASTER), F17 (2024-01-11) (GA-H310TN-CM), F5 (2024-01-11) (H310M D3H), F8 (2024-01-11) (Z390 AORUS XTREME WATERFORCE), F16 (2024-01-10) (B360M D2V), F16 (2024-01-10) (B360M H), F16 (2024-01-10) (B360M GAMING HD), F22f (2024-07-31) (GA-H110M-D3H), F22e (2024-07-31) (GA-H110M-D3H R2 TPM), F24a (2024-07-31) (GA-H110M-D3H R2), F16 (2024-01-10) (B360 AORUS GAMING 3), F16 (2024-01-10) (B360 AORUS GAMING 3 WIFI), F20h (2024-07-31) (GA-B150-HD3 DDR3), F18 (2024-01-11) (H310M S2H), FQ (2024-01-11) (H310M S2H), F17 (2024-01-11) (H310M DS2V), F23 (2023-12-20) (Z490 GAMING X AX), F23 (2023-12-20) (Z490 GAMING X), F23 (2023-12-20) (Z490 AORUS MASTER WATERFORCE), F5 (2024-01-04) (B460M H), F7 (2024-01-04) (B460M GAMING HD), F26a (2024-07-31) (GA-H110-D3A), F17 (2023-12-19) (B560 HD3), F7 (2024-01-04) (B460M DS3H AC), F8 (2024-01-04) (B460M AORUS PRO), F16 (2023-12-19) (H510M S2), F4 (2023-12-19) (B560M H V2), F16 (2023-12-19) (H510M DS2V), F19 (2023-12-19) (H510M H), F23 (2023-12-20) (Z490I AORUS ULTRA), F20h (2024-07-31) (GA-B150M-Gaming), F16 (2024-01-11) (B360 HD3P), F28b (2024-07-31) (GA-H110M-DS2 (rev. 1.0/1.1/1.2)), F8 (2023-12-20) (H470M K), FC (2023-12-20) (H410M K), F3 (2023-12-20) (H510M K V2), F3 (2023-12-20) (H510M S2H V3), FC (2023-12-20) (H410M H V2), F5 (2024-01-04) (H410M H V2), FC (2023-12-20) (H410M S2 V2), F5 (2024-01-04) (H410M S2 V2), F3 (2023-12-20) (H510M H V2), F3 (2023-12-20) (H510M S2 V2), F5 (2023-12-20) (H470M H), F10 (2023-12-19) (Z590 AORUS MASTER), F22a (2024-07-31) (GA-H110M-DS2V DDR3), F22h (2024-07-31) (GA-B150M-DS3H), F10 (2024-01-11) (Z390 AORUS XTREME), F9 (2023-12-20) (H410M S2H V3), F9 (2023-12-20) (H410M DS2V V3), F9 (2023-12-20) (H410M S2 V3), F9 (2023-12-20) (H410M H V3), FCa (2024-07-31) (GA-H110M-DS2), F22f (2024-07-31) (GA-B150M-D2V), F23 (2023-12-20) (Z490 VISION D), F4b (2024-08-22) (C621 AORUS XTREME), F23f (2024-07-31) (GA-H110TN-E), F19 (2024-01-10) (B360M DS3H), F6 (2024-01-04) (H410M S2H V2), F5 (2024-01-04) (H410M DS2V V2), F6 (2023-12-19) (H510M K), F10 (2023-12-19) (Z590 AORUS ELITE AX), F8 (2023-12-19) (Z590 AORUS ELITE)

Product types

Firmware

Mitigations

Использование рекомендаций производителя: https://www.gigabyte.com/Support/Security/2302

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Gigabyte Technology Co., Ltd.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "F22f (2024-07-31) (GA-H110M-S2HP), F10 (2023-12-19) (Z590 GAMING X), F13 (2023-12-19) (H510M S2H V2), F17 (2023-12-19) (H510M S2H), F26a (2024-07-31) (GA-H110M-S2V), F26g (2024-07-31) (GA-H110M-S2H), FA (2024-07-03) (H410M S2H V2 (rev. 1.9/2.1)), FA (2024-07-09) (H410M H V2 (rev. 1.9)), F21f (2024-07-31) (GA-B150M-DS3H DDR3), F21e (2024-07-31) (GA-H110M-S2V DDR3), F20g (2024-07-31) (GA-H110M-S2 DDR3), F15 (2023-12-19) (H510M DS2), F20h (2024-07-31) (G1.Sniper M7), F24h (2024-07-31) (GA-B150-HD3P), F20g (2024-07-31) (GA-H110M-DS2 DDR3), F13 (2024-01-11) (Z390 AORUS PRO WIFI), F13 (2024-01-11) (Z390 AORUS PRO), F23 (2023-12-20) (Z490 AORUS MASTER), F17 (2024-01-11) (GA-H310TN-CM), F5 (2024-01-11) (H310M D3H), F8 (2024-01-11) (Z390 AORUS XTREME WATERFORCE), F16 (2024-01-10) (B360M D2V), F16 (2024-01-10) (B360M H), F16 (2024-01-10) (B360M GAMING HD), F22f (2024-07-31) (GA-H110M-D3H), F22e (2024-07-31) (GA-H110M-D3H R2 TPM), F24a (2024-07-31) (GA-H110M-D3H R2), F16 (2024-01-10) (B360 AORUS GAMING 3), F16 (2024-01-10) (B360 AORUS GAMING 3 WIFI), F20h (2024-07-31) (GA-B150-HD3 DDR3), F18 (2024-01-11) (H310M S2H), FQ (2024-01-11) (H310M S2H), F17 (2024-01-11) (H310M DS2V), F23 (2023-12-20) (Z490 GAMING X AX), F23 (2023-12-20) (Z490 GAMING X), F23 (2023-12-20) (Z490 AORUS MASTER WATERFORCE), F5 (2024-01-04) (B460M H), F7 (2024-01-04) (B460M GAMING HD), F26a (2024-07-31) (GA-H110-D3A), F17 (2023-12-19) (B560 HD3), F7 (2024-01-04) (B460M DS3H AC), F8 (2024-01-04) (B460M AORUS PRO), F16 (2023-12-19) (H510M S2), F4 (2023-12-19) (B560M H V2), F16 (2023-12-19) (H510M DS2V), F19 (2023-12-19) (H510M H), F23 (2023-12-20) (Z490I AORUS ULTRA), F20h (2024-07-31) (GA-B150M-Gaming), F16 (2024-01-11) (B360 HD3P), F28b (2024-07-31) (GA-H110M-DS2 (rev. 1.0/1.1/1.2)), F8 (2023-12-20) (H470M K), FC (2023-12-20) (H410M K), F3 (2023-12-20) (H510M K V2), F3 (2023-12-20) (H510M S2H V3), FC (2023-12-20) (H410M H V2), F5 (2024-01-04) (H410M H V2), FC (2023-12-20) (H410M S2 V2), F5 (2024-01-04) (H410M S2 V2), F3 (2023-12-20) (H510M H V2), F3 (2023-12-20) (H510M S2 V2), F5 (2023-12-20) (H470M H), F10 (2023-12-19) (Z590 AORUS MASTER), F22a (2024-07-31) (GA-H110M-DS2V DDR3), F22h (2024-07-31) (GA-B150M-DS3H), F10 (2024-01-11) (Z390 AORUS XTREME), F9 (2023-12-20) (H410M S2H V3), F9 (2023-12-20) (H410M DS2V V3), F9 (2023-12-20) (H410M S2 V3), F9 (2023-12-20) (H410M H V3), FCa (2024-07-31) (GA-H110M-DS2), F22f (2024-07-31) (GA-B150M-D2V), F23 (2023-12-20) (Z490 VISION D), F4b (2024-08-22) (C621 AORUS XTREME), F23f (2024-07-31) (GA-H110TN-E), F19 (2024-01-10) (B360M DS3H), F6 (2024-01-04) (H410M S2H V2), F5 (2024-01-04) (H410M DS2V V2), F6 (2023-12-19) (H510M K), F10 (2023-12-19) (Z590 AORUS ELITE AX), F8 (2023-12-19) (Z590 AORUS ELITE)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.gigabyte.com/Support/Security/2302",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "15.04.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "01.08.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "01.08.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-09304",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-7026",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "GA-H110M-S2HP, Z590 GAMING X, H510M S2H V2, H510M S2H, GA-H110M-S2V, GA-H110M-S2H, H410M S2H V2 (rev. 1.9/2.1), H410M H V2 (rev. 1.9), GA-B150M-DS3H DDR3, GA-H110M-S2V DDR3, GA-H110M-S2 DDR3, H510M DS2, G1.Sniper M7, GA-B150-HD3P, GA-H110M-DS2 DDR3, Z390 AORUS PRO WIFI, Z390 AORUS PRO, Z490 AORUS MASTER, GA-H310TN-CM, H310M D3H, Z390 AORUS XTREME WATERFORCE, B360M D2V, B360M H, B360M GAMING HD, GA-H110M-D3H, GA-H110M-D3H R2 TPM, GA-H110M-D3H R2, B360 AORUS GAMING 3, B360 AORUS GAMING 3 WIFI, GA-B150-HD3 DDR3, H310M S2H, H310M DS2V, Z490 GAMING X AX, Z490 GAMING X, Z490 AORUS MASTER WATERFORCE, B460M H, B460M GAMING HD, GA-H110-D3A, B560 HD3, B460M DS3H AC, B460M AORUS PRO, H510M S2, B560M H V2, H510M DS2V, H510M H, Z490I AORUS ULTRA, GA-B150M-Gaming, B360 HD3P, GA-H110M-DS2 (rev. 1.0/1.1/1.2), H470M K, H410M K, H510M K V2, H510M S2H V3, H410M H V2, H410M S2 V2, H510M H V2, H510M S2 V2, H470M H, Z590 AORUS MASTER, GA-H110M-DS2V DDR3, GA-B150M-DS3H, Z390 AORUS XTREME, H410M S2H V3, H410M DS2V V3, H410M S2 V3, H410M H V3, GA-H110M-DS2, GA-B150M-D2V, Z490 VISION D, C621 AORUS XTREME, GA-H110TN-E, B360M DS3H, H410M S2H V2, H410M DS2V V2, H510M K, Z590 AORUS ELITE AX, Z590 AORUS ELITE",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 SwSmiInputValue() \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 System Management Interrupt (SMI) \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442 Gigabyte, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0435 \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f (CWE-822)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 SwSmiInputValue() \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 System Management Interrupt (SMI) \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442 Gigabyte \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.gigabyte.com/Support/Security/2302\nhttps://vuldb.com/?id.316178\nhttps://www.binarly.io/advisories/brly-dva-2025-008",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-822",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,2)"
}

CVE-2025-7026 (GCVE-0-2025-7026)

Vulnerability from cvelistv5 – Published: 2025-07-11 15:27 – Updated: 2026-02-26 17:50

Title

SMM Arbitrary Write via Unchecked RBX Pointer in CommandRcx0

Summary

A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values (e.g., '$DB$' or '2DB$'), the function performs arbitrary writes to System Management RAM (SMRAM), leading to potential privilege escalation to System Management Mode (SMM) and persistent firmware compromise.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-12 03:55 UTC

CWE

CWE-822 Untrusted Pointer Dereference

Assigner

certcc mitre root

References

4 references

URL	Tags
https://www.gigabyte.com/Support/Security
https://www.binarly.io/advisories/brly-dva-2025-008
https://kb.cert.org/vuls/id/746790
https://www.kb.cert.org/vuls/id/746790

Impacted products

1 product

Vendor	Product	Version
GIGABYTE	UEFI-GenericComponentSmmEntry	Affected: 1.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-7026",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-12T03:55:16.064357Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:50:43.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:07:19.993Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/746790"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "UEFI-GenericComponentSmmEntry",
          "vendor": "GIGABYTE",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values (e.g., \u0027$DB$\u0027 or \u00272DB$\u0027), the function performs arbitrary writes to System Management RAM (SMRAM), leading to potential privilege escalation to System Management Mode (SMM) and persistent firmware compromise."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-822 Untrusted Pointer Dereference",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-11T15:27:34.960Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://www.gigabyte.com/Support/Security"
        },
        {
          "url": "https://www.binarly.io/advisories/brly-dva-2025-008"
        },
        {
          "url": "https://kb.cert.org/vuls/id/746790"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SMM Arbitrary Write via Unchecked RBX Pointer in CommandRcx0",
      "x_generator": {
        "engine": "VINCE 3.0.21",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-7026"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2025-7026",
    "datePublished": "2025-07-11T15:27:34.960Z",
    "dateReserved": "2025-07-02T15:42:52.209Z",
    "dateUpdated": "2026-02-26T17:50:43.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.