CVE-2025-35991

The record

Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Affected packages

Related vulnerabilities

• CVE-2026-87616 Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36… CWE-665
• CVE-2026-78940 Improper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a… CWE-665
• CVE-2026-12233 The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credenti… CWE-665
• CVE-2026-54777 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET… CWE-665
• CVE-2026-54409 A malicious actor with access to the network and under certain conditions could exploit… CWE-665
• CVE-2026-54279 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-665
• GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook… CWE-665
• CVE-2026-12539 Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at… CWE-665