CVE-2025-32008

High

Published: 10 February 2026

Published

10 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS Score 0.0008 23.7th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-32008 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Intel (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the out-of-bounds write vulnerability in Intel AMT firmware by applying vendor-provided patches as detailed in Intel-SA-01315.

SC-5 Denial-of-service Protection good match

prevent

Protects system availability by implementing denial-of-service protections against the high-impact network-based DoS exploitation of this vulnerability.

SC-7 Boundary Protection partial match

prevent

Enforces boundary protections to monitor and control unauthenticated network access to vulnerable Intel AMT and Standard Manageability firmware interfaces.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Remote unauthenticated network exploitation of AMT firmware (public-facing management service) directly enables T1190; resulting high-impact availability disruption maps to T1499.004 via application/system exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Out-of-bounds write in the firmware for the Intel(R) AMT and Intel(R) Standard Manageability within Ring 3: User Applications may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of…

service. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.

Deeper analysisAI

CVE-2025-32008 is an out-of-bounds write vulnerability (CWE-787) in the firmware for Intel Active Management Technology (AMT) and Intel Standard Manageability, specifically within Ring 3 user applications. This flaw can enable a denial of service condition. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), indicating high severity due to its network accessibility, low attack complexity, lack of privileges or user interaction required, and scope change with high availability impact.

A network-based adversary can exploit this vulnerability without authentication using a low-complexity attack over the network, requiring no special internal knowledge or user interaction. Successful exploitation results in a denial of service, with high availability impact on the vulnerable system and low availability impact subsequently, while confidentiality and integrity remain unaffected.

Intel's security advisory (INTEL-SA-01315) at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01315.html provides further details on affected products and mitigation steps.