Intel Slim Bootloader: Escalation of privilege via untrusted pointer dereference
Summary
An untrusted pointer dereference in the FirmwareWakingVector of Intel Slim Bootloader may allow an escalation of privilege within Ring 0 (Bare Metal OS). The attacker needs local access and an already privileged account, and no user interaction is required. Successful exploitation could affect confidentiality, integrity and availability of the vulnerable system, potentially at firmware level before the operating system starts.
Affected
- Intel Slim Bootloader (affected versions and platforms not verified; the Intel advisory INTEL-SA-01526 could not be retrieved)
- Unknown.
Fixed in
Unknown. Check Intel advisory INTEL-SA-01526 and the hardware OEM for firmware updates.
Workaround
Unknown from available sources.
- If no firmware update is available, obtain updated firmware from the device OEM and restrict local administrative access.
Exploitation
- No known exploitation at time of publication.
- No CISA KEV entry or public proof-of-concept found; this is only absence of evidence given limited indexed data.
Our recommendation
- Check whether any devices in your fleet, especially embedded or industrial systems, use Intel Slim Bootloader.
- Review INTEL-SA-01526 and obtain firmware updates from your hardware vendors once available.
- Restrict local administrative access on affected systems.
- Re-check CISA KEV and public exploit sources in the following days.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Slim Bootloader Advisory INTEL-SA-01526 intel.com
- Intel Security Center www.intel.com
- NVD entry CVE-2025-50175 (related CVE ID, verify) nvd.nist.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:30.
Original description (NVD)
Untrusted pointer dereference in the FirmwareWakingVector for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.