CVE-2023-34440

CVE-2023-34440 is an improper input validation vulnerability (CWE-20) in the UEFI firmware for some Intel(R) Processors. Published on 2025-02-12, it carries a CVSS v3.1 base score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity with local attack vector, high attack complexity, and requirements for high privileges.

The vulnerability can be exploited by a privileged user with local access to the affected system. Exploitation may enable escalation of privilege, potentially resulting in high impacts to confidentiality, integrity, and availability, with a changed scope that could affect broader system components.

Intel's security advisory (INTEL-SA-01139) addresses the issue at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html. Debian LTS has also issued an announcement regarding related updates at https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html.