What’s Vulnerable › Vulnerabilities

CVE-2025-3052: An arbitrary write vulnerability in Microsoft signed UEFI firmware from DT Research Inc.

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-10 · updated 2026-06-17

Description

An arbitrary write vulnerability in Microsoft signed UEFI firmware allows for code execution of untrusted software. This allows an attacker to control its value, leading to arbitrary memory writes, including modification of critical firmware settings stored in NVRAM. Exploiting this vulnerability could enable security bypasses, persistence mechanisms, or full system compromise.

Affected products

• DT Research BiosFlashShell: 80.02, 81.02
• DT Research Dtbios: 70.17, 70.18, 70.19, 70.20, 70.21, 70.22 (+6)

References

• https://uefi.org/specs/UEFI/2.10/32_Secure_Boot_and_Driver_Signing.html
• https://www.binarly.io/advisories/brly-dva-2025-001
• https://www.kb.cert.org/vuls/id/806555

Get alerted when CVE-2025-3052 or the next vulnerability affects your stack