CVE-2025-7028 - CVE House
Back to Database
Status published Unknown CVE-2025-7028

SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock Pointer

Vulnerability Description

A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo) that dereference both the structure and its nested members, such as BufAddr. This enables arbitrary read/write access to System Management RAM (SMRAM), allowing an attacker to corrupt firmware memory, exfiltrate SMRAM content via flash, or install persistent implants.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-7028

Credits & Attribution

No credits recorded in the NVD database.

References

More from GIGABYTE

View All →
CVE-2025-7029
SMM Arbitrary Write via Unchecked OcHeader Buffer in Platform Configuration Handler
Unknown 0
CVE-2025-7027
SMM Arbitrary Write via Dual-Controlled Pointers in CommandRcx1
Unknown 0
CVE-2025-7026
SMM Arbitrary Write via Unchecked RBX Pointer in CommandRcx0
Unknown 0
CVE-2025-14302
GIGABYTE｜Motherboard - Protection Mechanism Failure
High 7
CVE-2017-3198
GIGABYTE BRIX UEFI firmware is not cryptographically signed
Critical 9.8

Affected Vendor

Affected Software

UEFI-SmiFlash
Vulnerable Versions:
1.0.0

Timeline

Official Publish: July 11th, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.