CVE-2025-35991

Improper input validation in some UEFI firmware SMM module for Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a low complexity attack may enable local code execution. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high.

Improper input validation in the UEFI ImcErrorHandler module for some Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high, but subsequent impacts are none.

Improper input validation in the UEFI FlashUcAcmSmm module for some Intel reference platforms may allow an escalation of privilege. A system software adversary with a privileged user combined with a high complexity attack may enable local code execution. This may occur via local access without special internal knowledge and requires no user interaction. The potential impact on confidentiality, integrity, and availability is high.

Some UEFI firmware for Intel(R) reference platforms contains an incomplete cleanup vulnerability that may allow information disclosure. A system software adversary with a privileged user and a low complexity attack may enable data exposure. This requires local access but no user interaction. The vulnerability may impact system confidentiality (high), but not integrity or availability.