The latest security information on Intel® products.

Summary: 

A potential security vulnerability in the Intel® Slim Bootloader may allow escalation of privilege. Intel is releasing firmware updates to mitigate this potential vulnerability.

Vulnerability Details: 

CVEID:  CVE-2025-35968

Description: Protection mechanism failure in the UEFI firmware for the Slim Bootloader within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS Base Score 4.0: 7.1 High

CVSS Vector 4.0:  CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Base Score 3.1: 6.4 Medium

CVSS Vector 3.1:  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products:

Recommendation:

Intel recommends updating Intel® Slim Bootloader to hash d81d535c5969d450ded84986e8e47a5fba2ddbf4 from May 28th, 2025 or later.

Acknowledgements:

The following issue was found internally by Intel employees.  Intel would like to thank Eng Koeng Hor and Bejean Mosher.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.