CVE-2026-81627

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

CVE-2026-81627 Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

CVE-2026-81627

A flaw in QEMU 's VAPIC setup hypercall (hw/i386/vapic.c) fails to validate that the writable RAM alias stays within the option ROM window. A privileged guest on a Q35/KVM machine can position this alias over locked SMRAM , bypassing chipset D_LCK protection and injecting code into System Managem...

CVE-2026-12855

CVE-2026-12855 is an unvalidated memory boundary flaw in H19WMIHandlerSmm , an SMM (System Management Mode) handler component in UEFI firmware. The vulnerable code was developed specifically for HP projects and is associated with Insyde firmware (per the Insyde security advisory reference). An at...

K000161517: Intel UEFI firmware vulnerability CVE-2025-20105

Security Advisory Description Improper input validation in some UEFI firmware SMM module for the IntelR reference platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may...

PT-2025-32958

Name of the Vulnerable Software and Affected Versions: Tcg2Smm affected versions not specified Description: Tcg2Smm contains a flaw that allows writing arbitrary memory inside SMRAM and executing arbitrary code at the SMM level. Recommendations: At the moment, there is no information about a newe...

CVE-2023-52711

Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to the SPI flash. The second issue can be used to both leak and corrupt SMM memory thus potentially...

CVE-2023-52710

CVE-2023-52710 affects Huawei MateBook D16 (Model CREM-WXX9, BIOS v2.26). The issue is insufficient validation of the communication buffer size, allowing partial overlap with the start of SMRAM and potentially enabling code execution in SMM. Connected documents confirm the affected hardware and r...

CVE-2023-52547: Improper Handling of Length Parameter Inconsistency

Huawei Matebook D16Model: CREM-WXX9, BIOS: v2.26. Memory Corruption in SMI Handler of HddPassword SMM Module. This can be leveraged by a malicious OS attacker to corrupt data structures stored at the beginning of SMRAM and can potentially lead to code execution in SMM...

CVE-2023-52710: Improper Check for Unusual or Exceptional Conditions

Huawei Matebook D16Model: CREM-WXX9, BIOS: v2.26, As the communication buffer size hasn’t been properly validated to be of the expected size, it can partially overlap with the beginning SMRAM.This can be leveraged by a malicious OS attacker to corrupt data structures stored at the beginning of...

PT-2024-3507 · Huawei · Huawei Matebook D16

Name of the Vulnerable Software and Affected Versions: Huawei Matebook D16 version v2.26 Description: The issue is related to a buffer overflow in the SMRAM memory of Huawei personal computers' UEFI BIOS microprogram, which can allow an attacker to execute arbitrary code in System Management Mode...

CVE-2023-20563

Insufficient protections in System Management Mode SMM code may allow an attacker to potentially enable escalation of privilege via local access...

CVE-2023-20571

A race condition in System Management Mode SMM code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentially resulting in privilege escalation...

Design/Logic Flaw

Insufficient protections in System Management Mode SMM code may allow an attacker to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Insufficient protections in System Management Mode SMM code may allow an attacker to potentially enable escalation of privilege via local access...

CVE-2023-20565

Insufficient protections in System Management Mode SMM code may allow an attacker to potentially enable escalation of privilege via local access...

CVE-2023-20565

CVE-2023-20565 is documented in AMD’s embedded/PI firmware advisories (AMD-SB-5001 and related) as a high-severity issue where insufficient protections in System Management Mode (SMM) could allow privilege escalation via local access. The connected AMD bulletin provides mitigations via Platform I...

CVE-2023-20563

Insufficient protections in System Management Mode SMM code may allow an attacker to potentially enable escalation of privilege via local access...

CVE-2023-20563

CVE-2023-20563 is a documented AMD/PI firmware vulnerability affecting System Management Mode (SMM) with local privilege escalation potential. The Connected AMD bulletin entries (AMD-SB-5001 and AMD-SB-4002) describe multiple affected AMD embedded platforms and indicate mitigations via Platform I...

CVE-2023-20571: Concurrent Execution using Shared Resource with Improper Synchronization

A race condition in System Management Mode SMM code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potentially resulting in privilege escalation...