Loading story…
A critical vulnerability has been identified in the UEFI firmware of several major motherboard brands, including ASRock, ASUS, MSI, and Gigabyte, which allows attackers to exploit the system during the early boot process via PCIe-connected DMA devices. This flaw enables malicious actors to bypass operating system security controls by taking advantage of the Input-Output Memory Management Unit (IOMMU) not fully initializing upon boot, leaving system RAM exposed to unauthorized access and manipulation.
The vulnerability has significant implications for both general system security and the integrity of anti-cheat mechanisms in online games. Riot Games, the developer of Valorant, has responded by blocking players who do not update their BIOS with the latest security patches, as the flaw allows sophisticated cheating devices to evade detection by anti-cheat software. Major motherboard vendors have released security updates to address the issue, and users are strongly advised to apply these patches to mitigate the risk of exploitation.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Riot Games updated its Vanguard anti-cheat protections so vulnerable systems without the required BIOS fixes could be blocked from launching Valorant or restricted from competitive play. Riot said enforcement would focus on systems associated with cheating risk rather than all players universally.
ASRock, ASUS, Gigabyte, and MSI acknowledged the issue and began publishing BIOS or firmware updates to correct early IOMMU initialization. Vendor and CERT advisories urged users and administrators to apply the patches promptly, especially where physical access cannot be tightly controlled.
The vulnerability was coordinated with CERT/CC and CERT Taiwan, and multiple CVEs were assigned: CVE-2025-11901, CVE-2025-14302, CVE-2025-14303, and CVE-2025-14304. Advisories highlighted that firmware could falsely report DMA protection as enabled while systems remained exposed before the OS loaded.
Nick Peterson and Mohamed Al-Sharifi of Riot Games identified a UEFI flaw affecting certain ASRock, ASUS, Gigabyte, and MSI motherboards. The bug leaves the IOMMU improperly initialized during early boot, enabling pre-boot DMA attacks via malicious PCIe devices with physical access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcearstechnica.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcesecurityonline.info
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Eclypsium discovered that nearly 200,000 Linux-based Framework laptops and desktops were shipped with signed UEFI shell components containing a powerful 'memory modify' (mm) command, which can be exploited to bypass Secure Boot protections. The mm command, intended for low-level diagnostics and firmware debugging, provides direct read and write access to system memory, including critical security variables such as gSecurity2. By abusing this command, an attacker can overwrite the gSecurity2 variable with NULL, effectively disabling signature verification for all subsequent UEFI module loads and breaking the Secure Boot trust chain. This vulnerability allows attackers to load bootkits such as BlackLotus, HybridPetya, and Bootkitty, which can evade operating system-level security controls and persist even after OS reinstallation. The attack can be automated using startup scripts, ensuring persistence across reboots. The issue is not the result of a supply chain compromise or malicious intent, but rather an oversight in the inclusion of diagnostic tools signed with trusted certificates. Eclypsium's research highlights that these signed UEFI shells, while legitimate, function as backdoors that undermine the security model of Secure Boot. The presence of such tools in production devices exposes users to significant risk, as attackers can leverage them for pre-OS infections, espionage, sabotage, or ransomware attacks. The gaming industry has already seen commercial cheat providers exploiting similar UEFI-level bypasses, and the same techniques could be adopted by nation-state actors or advanced persistent threats. Framework has acknowledged the issue and is working on remediation, with fixes planned for affected models such as the Framework 13 (11th and 12th Gen Intel). The discovery underscores the broader risk of trusted, signed components containing powerful functionality that can be misused, and the need for rigorous review of firmware-level tools included in shipping devices. The vulnerability demonstrates that even systems marketed as secure and repairable can harbor critical flaws if diagnostic utilities are not properly restricted. The incident serves as a warning to hardware manufacturers and the security community about the dangers of trusted but overly permissive firmware components. Eclypsium's findings have prompted a reassessment of trust models in firmware security, emphasizing the importance of minimizing attack surfaces in pre-boot environments. The case also illustrates how attackers are increasingly targeting lower layers of the computing stack to achieve persistence and evade detection. Framework's response and the ongoing remediation efforts will be closely watched by the industry as a test case for responsible disclosure and mitigation of firmware-level threats.
Jul 23, 2026
Security researcher Christopher Domas disclosed a hardware attack that abuses DRAM controller address-translation and scrambling logic to remap physical memory, allowing protected regions to alias into accessible addresses on older AMD processors. The technique was demonstrated against **AMD Family 16h** chips, where Domas reportedly extracted data from **Platform Security Processor (PSP)** memory, read **System Management Mode** contents from `SMRAM`, and recovered CPU state written to DRAM during `C6` idle transitions, undermining isolation below the CPU core. Reports say the weakness is tied to a "swizzle"-style memory-mapping mechanism and can also weaken protections associated with AMD memory-encryption technologies such as **SME/SEV** under certain conditions. The affected processor family includes chips used in **PlayStation 4** and **Xbox One** systems, while **AMD Family 17h** and later Zen-based processors are described as having architectural changes that mitigate or block this attack path. Domas characterized the issue as a broader class of architectural risk because similar memory-controller mapping designs are used across multiple CPU ecosystems, and the research is being released as the open-source project **skitter-creek-bath-salts** ahead of a Black Hat presentation.
Aug 15, 2026
Binarly Research reported that many AMD-based devices remain vulnerable to speculative execution attacks including **Spectre v1**, **Spectre v2**, and **Retbleed** because firmware and hardware mitigations are not being developed, validated, and delivered consistently across the ecosystem. The findings point to a broad firmware attack surface in **UEFI** and **System Management Mode (SMM)**, where weaknesses below the operating system can leave systems exposed even after years of industry attention on side-channel defenses. The research says asynchronous patching across the hardware and firmware supply chain, combined with limited advisory transparency, has left protections uneven throughout device lifecycles. Binarly warned that these foundational hardware security issues persist in modern AMD environments despite broader emphasis on confidential computing, creating conditions in which attackers could still exploit older speculative execution flaws against current systems.
Jun 29, 2026