CVE-2025-29950

High

Published: 10/02/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

CVE-2025-29950 is caused by improper input validation in System Management Mode (SMM). A privileged attacker could exploit this flaw to overwrite stack memory, potentially leading to arbitrary code execution.

Risk Assessment

The risk to the organization includes potential takeover of the system by a privileged attacker, which could compromise data integrity and confidentiality and lead to privilege escalation.

Recommendation

It is recommended to apply vendor-provided patches immediately and restrict privileged access to systems to minimize the risk of exploitation.

Other vulnerabilities in System Management Mode (SMM)

CVE-2026-0438Medium
A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker could, with active user interaction and under high complexity and present preconditions, trigger execution of attacker-controlled code in SMM, potentially compromising the system’s confidentiality, integrity, and availability.

Original NVD description (English source)

Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS