CVE-2025-58774
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-58774 is a high-severity Buffer Access with Incorrect Length Value (CWE-805) vulnerability in Ami (inferred from references). Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-211078
Vulnerability Data
AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity,…
more
and Availability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including fuzzing and static analysis) directly finds incorrect length values used in sequential buffer accesses.
Secure engineering principles require explicit bounds checking and correct length calculations when performing buffer operations.
Input validation rejects or corrects malformed length values supplied from external sources before they reach buffer operations.
Memory protection mechanisms limit the blast radius when an incorrect length value causes an out-of-bounds access.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that reach buffer-length issues in custom code, but leaves a bounded remainder (e.g. third-party libraries, legacy code, incomplete enforcement of guidelines, or outsourced development without full assurance).
Application security requirements can specify buffer-size validation, but do not prescribe implementation details.
A.8.27 mandates security-by-design, defence-in-depth, least privilege, distrust-external-input, hardening, and design reviews against known attack patterns; these reach a minority slice of CWE-805 (e.g. safe API selection or bounds-aware length computation) but leave most buffer-length errors still introducible and exploitable in the remaining implementation surface.
Secure coding explicitly requires correct buffer-length handling, eliminating CWE-805 when followed.