CVE-2024-28127

CVE-2024-28127 is an improper input validation vulnerability, classified under CWE-20, affecting the UEFI firmware for some Intel(R) Processors. Published on 2025-02-12, it carries a CVSS v3.1 base score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating high severity with local attack vector, high attack complexity, and requirements for high privileges.

The vulnerability can be exploited by a privileged user with local access, potentially enabling escalation of privilege. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, compounded by a change in scope that amplifies the consequences beyond the vulnerable component.

Intel's security advisory INTEL-SA-01139 provides details on the issue at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html. Debian LTS has also issued an announcement related to this CVE at https://lists.debian.org/debian-lts-announce/2025/03/msg00021.html.