Description
An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DT Research | BiosFlashShell | 80.02, 81.02 | — |
| DT Research | Dtbios | 70.17, 70.18, 70.19, 70.20, 70.21, 70.22, 71.17, 71.18, 71.19, 71.20, 71.21, 71.22 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
TheMalwareGuardian/CVE-2025-3052 ★ 0 · Jan 9, 2026
Research on CVE-2025-3052, an Insyde firmware vulnerability that exposes an arbitrary write primitive capable of modifying security-critical pointers.
-
m4rm0k/talkingBen ★ 0 · Oct 31, 2025
planned to be a root kit that is ingrained inside of the UEFI bootloader, but first does priviliage escalation and will be constantly update with probably a c2 server and anti EDR and AV's prevention…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- WID-SEC-2025-1277 Microsoft Windows: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2025
- NCSC-2025-0188 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Jun 10, 2025