New UEFI Vulnerability Exposes Motherboards from ASUS, Gigabyte, MSI, and ASRock
- Securityish
- Threats & Incidents
Quick Summary
A new UEFI vulnerability affects motherboards from ASUS, Gigabyte, MSI, and ASRock, allowing direct memory access (DMA) attacks that bypass early-boot protections. Identified by CVE-2025-11901, CVE-2025-14302, CVE-2025-14303, and CVE-2025-14304, this flaw can enable unauthorized access to system memory before operating system safeguards are in place. Users are advised to check for firmware updates to mitigate risks associated with this vulnerability.
The Securityish Brief
The UEFI firmware vulnerability discovered by Riot Games researchers Nick Peterson and Mohamed Al-Sharifi affects motherboards from ASUS, Gigabyte, MSI, and ASRock. This flaw allows direct memory access (DMA) attacks, which can bypass early-boot memory protections, leaving systems exposed to potential exploitation. The vulnerability is identified by multiple CVE codes: CVE-2025-11901, CVE-2025-14302, CVE-2025-14303, and CVE-2025-14304, indicating variations in vendor implementations.
During the early boot phase, the IOMMU, a hardware-enforced memory firewall, must activate to prevent DMA attacks. However, the vulnerability allows a malicious PCIe device to read or modify system memory before the operating system loads, as the firmware incorrectly asserts that DMA protections are active. This misconfiguration can lead to significant security risks, including the potential for malicious code to compromise the operating system.
Riot Games has implemented changes to its Vanguard anti-cheat system, blocking the launch of its games like Valorant on affected systems. This is due to the inability to guarantee system integrity when DMA protections are not properly configured. The researchers emphasized that the vulnerability poses a risk not only to gaming but also to broader cybersecurity, as it allows unauthorized access to sensitive system memory.
Carnegie Mellon CERT/CC confirmed the broad impact of this vulnerability, stating that it affects various motherboard models from the mentioned manufacturers. Users are encouraged to review the security bulletins from their respective vendors to identify affected models and apply necessary firmware updates.
Given that exploitation occurs before the operating system boots, users will not receive alerts or warnings from security tools, making it crucial to stay informed about firmware updates and security practices.
Key Takeaways
- Check for firmware updates from your motherboard manufacturer to address the UEFI vulnerability.
- Back up important data before applying any firmware updates to prevent data loss.
- Monitor system alerts from Riot Games if you play titles like Valorant, as they may indicate security issues.
- Consider physical security measures to prevent unauthorized access to your system’s hardware.
- Stay informed about cybersecurity news to understand emerging threats and vulnerabilities.
Key Terms & Concepts
- UEFI: In this article, UEFI refers to the Unified Extensible Firmware Interface, which initializes hardware and software during the boot process.
- DMA: In this article, DMA stands for Direct Memory Access, a feature that allows devices to access system memory directly without CPU intervention.
- IOMMU: In this article, IOMMU refers to Input-Output Memory Management Unit, a hardware component that controls memory access for devices.
- CVE: In this article, CVE refers to Common Vulnerabilities and Exposures, a list of publicly disclosed cybersecurity vulnerabilities.
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
