Motherboard vendors have begun releasing firmware updates for a UEFI flaw that can leave some ASRock, ASUS, GIGABYTE and MSI systems vulnerable to memory access attacks before the operating system loads. The issue, detailed in security advisories published on December 17, 2025, requires an attacker to have physical access and connect a malicious DMA-capable PCIe device.
The CERT Coordination Center says affected firmware can indicate that direct memory access (DMA) protection is active while failing to properly configure and enable the Input–Output Memory Management Unit (IOMMU) during early boot. That leaves a gap before operating-system security controls take effect.
The IOMMU restricts which regions of memory peripheral devices can access. Without that protection, a malicious device could read sensitive data or modify memory during startup. CERT/CC says the flaw could also enable pre-boot code injection and compromise the integrity of the boot process.
Riot Games researchers Nick Peterson and Mohamed Al-Sharifi identified the issue and worked with vendor teams and Taiwan’s computer emergency response team to coordinate the response.
Affected motherboards
The issue is tracked under four identifiers: CVE-2025-11901, CVE-2025-14302, CVE-2025-14303 and CVE-2025-14304. The affected products include specific motherboard models; the findings do not establish that every board from the four manufacturers is vulnerable.
TWCERT/CC lists CVE-2025-14304 as affecting certain ASRock, ASRock Rack and ASRock Industrial motherboards based on Intel 500, 600, 700 and 800 series chipsets.
In a December 16 statement, ASUS identified affected motherboards using Intel Z490, W480, B460, H410, Z590, B560, H510, Z690, B660, W680, Z790, B760 and W790 chipsets.
For GIGABYTE, TWCERT/CC lists CVE-2025-14302 as affecting certain motherboards using Intel 600, 700 and 800 series chipsets, as well as AMD 600 and 800 series chipsets and TRX50.
TWCERT/CC assigns the ASRock and GIGABYTE vulnerabilities a CVSS v3.1 score of 6.8, classified as Medium. Both advisories describe attacks that require physical access but no authentication.
Firmware fixes and configuration
As of December 20, 2025, firmware updates were being released on varying vendor timelines. CERT/CC says the fixes correct IOMMU initialization so DMA protections are enforced throughout boot, and advises users and administrators to apply updates as they become available.
ASUS instructs affected users to install the specified BIOS update and set IOMMU DMA Protection to “Enable with Full Protection” in the BIOS Setup Utility.
CERT/CC recommends prioritizing updates in environments where physical access is difficult to control, because exploitation depends on connecting a malicious device to the affected computer.
