CVE-2025-62863 Memory corruption in n/a
An incorrectly formed SMC call in the UEFI-MM PCIe driver allows out-of-bounds writes, potentially enabling code execution or privilege escalation on AmpereOne devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62863?
CVE-2025-62863 is a critical memory corruption vulnerability in n/a, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM PCIe driver that could result in an out-of-bounds write within PCIe driver’s S-EL0 address space.
Weakness: CWE-787
Which versions are affected by CVE-2025-62863?
It affects 13 products.
Products include Amperecomputing Ampereone A128-34x Firmware, Amperecomputing Ampereone A144-24x Firmware, Amperecomputing Ampereone A144-26m Firmware, Amperecomputing Ampereone A144-27x Firmware, Amperecomputing Ampereone A144-33m Firmware, Amperecomputing Ampereone A160-28m Firmware and 7 more.
How do I fix CVE-2025-62863?
No fix has been published for CVE-2025-62863 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-62863 being exploited?
There is no known exploitation of CVE-2025-62863 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-3m34-6w3v-w8gq.