Vulnerability in Gigabyte Uefi-Overclocksmihandler
CVE-2025-7029
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers (OcHeader, OcData) passed into power and thermal configuration logic. These buffers are not validated before performing multiple structured memory writes based on OcSetup NVRAM values, enabling arbitrary SMRAM corruption and potential SMM privilege escalation.
EPSS: 0.002 (9.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Gigabyte Uefi-overclocksmihandler — versions 1.0.0
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-7029?
- CVE-2025-7029 is a high-severity vulnerability in Gigabyte Uefi-Overclocksmihandler, classified under CWE-822 UNCONTROLLED POINTER DEFERENCE. CVSS score: 8.2/10. Published 2025-07-11.
- How severe is CVE-2025-7029?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2025-7029 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.