CVE-2025-4277 Tcg2Smm: improper input validation may lead to arbitrary code execution

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level...

CVE-2025-4277

CVE-2025-4277 is described across multiple sources as a vulnerability in InsydeH2O firmware (Tcg2Smm) that can write arbitrary memory inside SMRAM and execute arbitrary code at the SMM level. The root cause indicated in CVE records is improper input handling/execution flow that enables arbitrary ...

CVE-2025-4276

CVE-2025-4276 affects UsbCoreDxe (EFI/UEFI) and related InsydeH2O implementations. The vulnerability stems from an ability to write to arbitrary memory in SMRAM, enabling arbitrary code execution at System Management Mode (SMM). Reported impact is execution of code with SMM privileges and potenti...

CVE-2025-4277: Improper Input Validation

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level...

Insyde InsydeH2O 安全漏洞

Insyde InsydeH2O is a new EFI/UEFI specification from Insyde China. It is intended to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O that originates from the ability to write to arbitrary memory in SMRAM and execute arbitrary code at th...

PT-2025-32957

Name of the Vulnerable Software and Affected Versions: UsbCoreDxe affected versions not specified Description: UsbCoreDxe contains a flaw that allows writing to arbitrary memory locations within the System Management RAM SMRAM. Successful exploitation of this issue can lead to arbitrary code...

CVE-2025-4276: Improper Input Validation

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level...

PT-2025-32958

Name of the Vulnerable Software and Affected Versions: Tcg2Smm affected versions not specified Description: Tcg2Smm contains a flaw that allows writing arbitrary memory inside SMRAM and executing arbitrary code at the SMM level. Recommendations: At the moment, there is no information about a newe...

CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

CVE-2025-25180

A security vulnerability exists in the Imagination GPU Driver where a non-privileged user can conduct improper GPU system calls . This allows an attacker to subvert the GPU hardware to write to arbitrary physical memory pages . The impact includes the potential corruption of data pages used by th...

CVE-2025-7028 SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock Pointer

A vulnerability in the Software SMI handler SwSmiInputValue 0x20 allows a local attacker to supply a crafted pointer FuncBlock through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo that...

CVE-2025-7028 SMM Arbitrary Memory Access via Flash Handler with Unchecked FuncBlock Pointer

A vulnerability in the Software SMI handler SwSmiInputValue 0x20 allows a local attacker to supply a crafted pointer FuncBlock through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions ReadFlash, WriteFlash, EraseFlash, and GetFlashInfo that...

CVE-2025-7028

A vulnerability exists in the Software SMI handler (SwSmiInputValue 0x20) of GIGABYTE motherboard microprogramming software, specifically involving the FuncBlock pointer. A local attacker can supply crafted pointers via RBX and RCX register values, which are passed unchecked into flash management...

CVE-2025-7027: Undefined Security Weakness

A vulnerability in the Software SMI handler SwSmiInputValue 0xB2 allows a local attacker to control both the read and write addresses used by the CommandRcx1 function. The write target is derived from an unvalidated UEFI NVRAM variable SetupXtuBufferAddress, while the write content is read from a...

GIGABYTE Chipsets 安全漏洞

GIGABYTE Chipsets is a series of chipsets open-sourced by GIGABYTE of Taiwan, China. A security vulnerability exists in GIGABYTE Chipsets that originates from an unverified pointer and could lead to arbitrary memory writes and elevation of privilege...

CVE-2025-53628: Loop with Unreachable Exit Condition

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnerability is related...

ESP-IDF 数字错误漏洞

ESP-IDF is an Espressif open source development framework for Espressif SoCs supported on Windows, Linux and macOS. A numeric error vulnerability exists in ESP-IDF versions 5.4.1, 5.3.3, 5.2.5, and 5.1.6, which stems from an integer underflow in the ESP-NOW protocol implementation that could lead...

CVE-2025-6199

CVE-2025-6199 affects the GIF LZW decoder in GdkPixbuf (gdk-pixbuf2). When an invalid symbol is decompressed, the output size is set to the full buffer length instead of the number of written bytes, causing uninitialized buffer areas to be emitted and potentially leaking memory contents from GIF ...

TencentOS Server 4: nss (TSSA-2024:0636)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0636 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

TencentOS Server 2: nss (TSSA-2023:0035)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0035 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...