CVE-2026-0438
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker could, with active user interaction and under high complexity and present preconditions, trigger execution of attacker-controlled code in SMM, potentially compromising the system’s confidentiality, integrity, and availability.
Risk Assessment
Exploitation could allow control at the lowest system level, risking full compromise of confidentiality, integrity, and availability.
Recommendation
Apply firmware/BIOS updates from the hardware vendor containing the SMM fix and limit administrative privileges to the necessary minimum.
Other vulnerabilities in System Management Mode (SMM)
Original NVD description (English source)
A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker could, with active user interaction and under high complexity and present preconditions, trigger execution of attacker-controlled code in SMM, potentially compromising the system’s confidentiality, integrity, and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS