What is CVE-2022-28806?

CVE-2022-28806 is a high-severity vulnerability in Fujitsu Lifebook A3510, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2022-05-04.

How severe is CVE-2022-28806?

High severity. CVSS v3 base score is 7.8 out of 10.

Buffer overflow in Fujitsu Lifebook A3510

CVE-2022-28806

An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM.

Vulnerability class: Buffer Overflow

Published 2022-05-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.005 (38.9th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000

Affected products

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

References

www.binarly.io/advisories (Exploit, Third Party Advisory)
kb.cert.org/vuls/id/796611 (US Government Resource, Third Party Advisory)
support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-09090… (Vendor Advisory)
www.fmworld.net/biz/common/insyde/20220210/ (Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2022-28806?: CVE-2022-28806 is a high-severity vulnerability in Fujitsu Lifebook A3510, classified under Out-of-bounds Write. CVSS score: 7.8/10. Published 2022-05-04.
How severe is CVE-2022-28806?: High severity. CVSS v3 base score is 7.8 out of 10.