CVE Feed

    Dashboard / CVE / CVE-2025-35991

    CVE-2025-35991

    Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

    Published:May 12, 2026
    Last Modified:May 13, 2026
    EPS:May 12, 2026
    EPSS Score:
    CVSS Score:5.6

    Affected Products

    Vendor
    Intel
    Product
    Uefi Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-665 Improper Initialization

    Related CVEs

    CVE-2025-22850 (CVSS 5.6) — Time-of-check time-of-use race condition in the UEFI PdaSmm module for some Intel(R) reference platforms may a…
    CVE-2025-22444 (CVSS 5.6) — Exposure of resource to wrong sphere in the UEFI PdaSmm module for some Intel(R) reference platforms may allow…
    CVE-2025-20105 (CVSS 8.7) — Improper input validation in some UEFI firmware SMM module for the Intel(R) reference platforms may allow an e…
    CVE-2025-20073 (CVSS 1.8) — Improper buffer restrictions in the UEFI DXE module for some Intel(R) Reference Platforms within UEFI may allo…
    CVE-2025-20068 (CVSS 7.1) — Improper input validation in the UEFI ImcErrorHandler module for some Intel(R) reference platforms may allow a…
    CVE-2025-20064 (CVSS 8.7) — Improper input validation in the UEFI FlashUcAcmSmm module for some Intel(R) reference platforms may allow an …
    CVE-2025-20028 (CVSS 7.1) — Time-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may …
    CVE-2025-20027 (CVSS 7.1) — Improper input validation in the UEFI WheaERST module for some Intel(R) reference platforms may allow an escal…
    CVE-2025-20005 (CVSS 5.6) — Improper buffer restrictions in some UEFI firmware for some Intel(R) reference platforms may allow an escalati…
    CVE-2025-20096 (CVSS 5.9) — Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of p…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High