CVE-2026-25194

LowCVSS 1.8/10Last modified Aug 12, 2026

Description

Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 4.0 1.8/10CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Aug 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-251956.6An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remoteCVE-2026-251968.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote coCVE-2026-251978.1A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.CVE-2026-251985.1web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploCVE-2026-251999.1Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects ApachCVE-2026-25205.4The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due toCVE-2026-252009.8A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can rCVE-2026-252018.8An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue CVE-2026-252029.8The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue CVE-2026-252037.8Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: lCVE-2026-252047.5Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process aCVE-2026-252059.8Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash 
CVE-2026-25194: Low severity, CVSS 1.8 | Vulnix