Skip to content
OpenAdvisories
High · 8.2 Public exploit CVE-2025-7029 EUVD-2025-21142GHSA-35m5-23fr-x9rq

SMM Arbitrary Write via Unchecked OcHeader Buffer in Platform Configuration Handler

Published Jul 11, 2025 · Updated Feb 26, 2026 · Assigned by certcc

Vendor: GIGABYTE Product: UEFI-OverClockSmiHandler

Description

A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers (OcHeader, OcData) passed into power and thermal configuration logic. These buffers are not validated before performing multiple structured memory writes based on OcSetup NVRAM values, enabling arbitrary SMRAM corruption and potential SMM privilege escalation.

Affected products

VendorProductAffectedFixed
GIGABYTE UEFI-OverClockSmiHandler 1.0.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • ARES-SYS/uefi_bootkit_softlanding ★ 0 · Aug 1, 2026

    First public analysis of SoftLanding UEFI bootkit: Ring -2 implant, CVE-2025-7029, 240+ Gigabyte boards, GPU AI evasion, dual C2. YARA + Sigma + Suricata included.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References