Local Exploit in Software SMI Handler Affects Gigabyte Products

CVE-2025-7028

What is CVE-2025-7028?

A vulnerability in the Software SMI handler allows local attackers to exploit unchecked pointer dereferencing in multiple flash management functions. By supplying a carefully crafted pointer through specific CPU register values, an attacker can gain unauthorized access to System Management RAM (SMRAM). This exploitation can lead to firmware memory corruption, extraction of sensitive information, and the installation of persistent malware, posing significant risks to affected Gigabyte products.

References