External risk intelligence

AmpereOne Firmware Out-of-Bounds Write Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-62864

The vulnerability affects UEFI-MM firmware, which operates at the system firmware level. Accessing such low-level interfaces generally requires local, privileged, or physical access and is not exposed as a public-facing network service or internet-accessible application.

Out-of-bounds Write

Amperecomputing Ampereone A192 32m Firmware

before 5.4.5.1before 4.4.5.2before 3.5.9.3

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability impacts AmpereOne devices, allowing potential unauthorized control through a specific system call. The issue lies in how the system handles certain communication requests, which could lead to broader security compromises if exploited. Understanding the scope of affected systems is the primary concern given the nature of this vulnerability.

Vulnerability allows system control via a specific call.
Critical flaw impacts core device firmware.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerability by sending a specially crafted SMC call to the UEFI-MM Communicate service. This could allow an out-of-bounds write within the UEFI-MM Secure Partition context, potentially leading to a compromise of system integrity and confidentiality.

Requires network access.
Triggered by malformed SMC call.
Leads to data corruption and compromise.

Live Threat

Current exploitation, exposure, and threat context

An incorrectly formed SMC call to the UEFI-MM MMCommunicate service could lead to an out-of-bounds write within the UEFI-MM Secure Partition context. This could affect system data and service behavior under specific conditions.

System data and service behavior.
Malformed calls to a specific service.
Unauthorized data manipulation or service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and infrastructure teams are likely responsible for managing Ampere AmpereOne devices, as this vulnerability resides in the UEFI-MM firmware. The first practical step is to identify all deployed AmpereOne devices, confirm their exposure, and determine business criticality to prioritize remediation efforts.

Own: Infrastructure and platform teams.
Verify: Device exposure and criticality.
Action: Plan coordinated firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AmpereOne hardware and its firmware?

AmpereOne is a family of high-performance cloud-native processors used in server environments. The affected software components are the UEFI firmware versions running on specific AC03, AC04, and M series models. This firmware manages low-level hardware initialization and the communication between the operating system and platform hardware.

What is the vulnerability class for CVE-2025-62864?

This vulnerability is classified as an out-of-bounds write (CWE-787). In simple terms, it means the system's UEFI-MM service does not properly validate data size before writing it into memory. Because of this, an attacker sending a malformed communication request can force the system to write data outside of its allowed storage area, potentially corrupting sensitive memory regions.

How can an attacker trigger this vulnerability?

The flaw is triggered by sending a specifically crafted Secure Monitor Call (SMC) to the UEFI-MM Communicate service. This vulnerability does not trigger through standard application-level network traffic or routine user inputs. It requires an interaction directed at the low-level management interfaces of the processor firmware.

Do I need to worry about this if my server is on the internet?

According to Halo Surface Signal, this is very unlikely to be an internet-facing threat. Because the vulnerability exists at the UEFI firmware level, it typically requires a level of access that is not reachable via standard web services. It is generally protected by the layers of software and hardware control between your applications and the physical processor.

What are the first steps for managing this threat?

Begin by auditing your hardware inventory to identify any systems running the affected AmpereOne processor models. Once you have a list of potentially impacted hardware, coordinate with your infrastructure or platform management teams to verify current firmware versions against the provided security thresholds and plan for authorized updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.