CVE-2025-62864 Memory corruption in n/a
An attacker can trigger an out-of-bounds write in the UEFI-MM Secure Partition via a malformed SMC call, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62864?
CVE-2025-62864 is a critical memory corruption vulnerability in n/a, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM MMCommunicate service that could result in an out-of-bounds write within the UEFI-MM Secure Partition context.
Weakness: CWE-787
Which versions are affected by CVE-2025-62864?
It affects 13 products.
Products include Amperecomputing Ampereone A128-34x Firmware, Amperecomputing Ampereone A144-24x Firmware, Amperecomputing Ampereone A144-26m Firmware, Amperecomputing Ampereone A144-27x Firmware, Amperecomputing Ampereone A144-33m Firmware, Amperecomputing Ampereone A160-28m Firmware and 7 more.
How do I fix CVE-2025-62864?
No fix has been published for CVE-2025-62864 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-62864 being exploited?
There is no known exploitation of CVE-2025-62864 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-66wq-fq77-7cfq.