UEFI Vulnerability in Major Motherboards Enables Early-Boot Attacks

Motherboard vendors including ASRock, Asus, Gigabyte, and MSI have disclosed a UEFI-related vulnerability that could enable early-boot DMA attacks. According to a CERT/CC advisory published on 18 December 2025, an attacker with physical access can exploit the flaw to access memory data or influence the system’s initial state by attaching a malicious PCIe device.

The issue stems from a protection mechanism failure in UEFI implementations and the IOMMU, where DMA protections appear enabled during boot but are not properly configured until just before handing control to the operating system. The advisory assigns CVE-2025-11901, CVE-2025-14302, CVE-2025-14303, and CVE-2025-14304, and notes that several vendors have released firmware patches while others remain with unknown status. Researchers from Riot Games responsibly disclosed the flaw.

Written by Eduard Kovacs for SecurityWeek, the piece emphasises that exploitation requires physical access and highlights the ongoing patching efforts by affected vendors.