CVE-2025-31648
CVE-2025-31648 is a low-severity vulnerability with a CVSS 3.x base score of 3.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-229.
Key facts
- Severity: Low (CVSS 3.x base score 3.9)
- CVSS v4: 1.8
- EPSS exploit prediction: 0% (3rd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-207126
- Weakness: CWE-229
- Published:
- Last modified:
Description
Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (low) and availability (none) impacts.
Frequently asked questions
- What is CVE-2025-31648?
- Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (low) and availability (none) impacts.
- How severe is CVE-2025-31648?
- CVE-2025-31648 has a CVSS 3.x base score of 3.9, rated low severity. It is exploitable over local access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2025-31648 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-31648?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-31648 have an EU (EUVD) identifier?
- Yes. CVE-2025-31648 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-207126.
- When was CVE-2025-31648 published?
- CVE-2025-31648 was published on 2026-02-10 and last updated on 2026-06-17.
References
Other CWE-229 vulnerabilities
- CVE-2025-7964 — Critical (CVSS 9.2): After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to…
- CVE-2024-39531 — High (CVSS 7.5): An Improper Handling of Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved…
- CVE-2022-24412 — High (CVSS 7.5): Dell EMC PowerScale OneFS 8.2.x - 9.3.0.x contain an improper handling of value vulnerability. An unprivileged network…
- CVE-2022-22562 — High (CVSS 7.5): Dell PowerScale OneFS, versions 8.2.0-9.3.0, contain a improper handling of missing values exploit. An unauthenticated…
- CVE-2026-4736 — High (CVSS 7.3): Improper Handling of Values vulnerability in No-Chicken Echo-Mate…
- CVE-2024-29460 — Medium (CVSS 6.6): An issue in PX4 Autopilot v.1.14.0 allows an attacker to manipulate the flight path allowing for crashes of the drone…