7.2
High
CVE-2025-24305 Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R)…
Description
Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R) processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NExploitable with local access to the machine, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- High
- Interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Intel(R) Xeon(R) Processors | Versions not published |
Other CVEs of Intel(R) Xeon(R) Processors
The 8 CVEs of Intel(R) Xeon(R) Processors →
CVE-2026-20901
Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege
4.0
Medium
CVE-2025-21090
Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an authenticated user to…
6.5
Medium
CVE-2024-37020
Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R)…
3.8
Low
CVE-2024-25565
Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated…
3.8
Low