CVE-2025-62863
CWE-787Published: December 16, 2025· Updated: Jun 17, 2026
Official Description
Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM PCIe driver that could result in an out-of-bounds write within PCIe driver’s S-EL0 address space.
Risk Analysis
AmpereOne devices contain an out-of-bounds write vulnerability in the UEFI-MM PCIe driver. An attacker can exploit this via an incorrectly formed SMC call to gain unauthorized access to the driver's memory space.
No public exploit is currently known for this remotely exploitable vulnerability.
Update device firmware to the latest versions (3.5.9.3, 4.4.5.2, or 5.4.5.1 depending on the model) to remediate the driver vulnerability.
Technical Analysis
CVE-2025-62863 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (2)
Quick Facts
Related CVEs (CWE-787)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-62863 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts