Forty million devices are running firmware with a known flaw right now, and the patch may never come for yours.

That is not a headline designed to scare you into buying something. That is the finding from Binarly’s 2025 firmware threat research, and it applies to laptops, desktops, and embedded systems from some of the most trusted brands on the market. You can have automatic updates turned on. You can be current on every Windows or macOS patch. You can do everything right on the surface layer, and still be completely exposed at a level most users never think to check.

I dug into the actual research so you do not have to. Here is what I found.

The Myth That Keeps People Comfortable

The widely held belief is simple: if your operating system is up to date, your device is secure. Microsoft and Apple have both built this assumption into their marketing. Automatic updates are framed as a complete solution. And who benefits from you not knowing that firmware sits entirely outside that update loop? The companies that would have to fund, test, and distribute those fixes do. Convenient, right?

Your operating system lives on top of your firmware the way a tenant lives in a building. When the tenant repaints the walls and fixes the faucets, the building’s foundation is untouched. UEFI firmware is that foundation. It initializes your hardware before your operating system even loads, which means a vulnerability there exists in a layer that your antivirus software cannot see and your Windows Update cannot reach.

Think of it this way: patching your OS while leaving your UEFI untouched is like changing the locks on your front door while leaving the basement window open. The new lock is real. The protection is not complete.

What the Research Actually Says

Binarly’s 2025 analysis identified critical vulnerabilities in UEFI firmware affecting an estimated 40 million devices globally. These are not theoretical attack vectors. They are documented flaws in code that ships from the factory and, in many cases, never receives an update for the entire lifespan of the device.

Marcus, a freelance attorney in Chicago, ran every Windows update the day it dropped. He assumed he was covered. He was not. His UEFI firmware had not been touched since his laptop shipped in 2021, and his model had already been flagged in Binarly’s 2023 firmware scanning data as carrying an unpatched configuration flaw. He only found out because a security-conscious colleague sent him a link. Most people never get that link.

The vulnerability class Binarly focuses on involves improper validation and memory corruption issues at the firmware level. A 2022 Binarly report identified over 23 high-severity UEFI vulnerabilities across devices from multiple major vendors in a single research cycle. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, has separately documented UEFI as an active threat surface in its Known Exploited Vulnerabilities catalog, noting that firmware-level attacks are increasingly favored by advanced threat actors precisely because they persist through OS reinstalls and are invisible to conventional security tools.

Did You Know: A firmware-level attack can survive a full factory reset. If an attacker embeds malicious code in your UEFI, wiping and reinstalling your operating system does not remove it. The threat lives below the floor you just cleaned.

When did you last check your firmware version? If you cannot answer that, you have your answer.

Why This Flaw Stays Hidden

The gap between OS patching and firmware patching is not an accident. Firmware updates are complex to distribute, carry a small but real risk of bricking a device if flashed incorrectly, and require the manufacturer to maintain update infrastructure for every model they have ever shipped. At a certain point, manufacturers declare a device end-of-support, stop issuing firmware updates, and move on. The device still works. The vulnerability stays.

Ask yourself why they do not advertise this part. A laptop that is three years old but still runs fine looks like a working product. It may also be a product whose firmware will never be patched again. The manufacturer has no legal obligation to tell you which category your device falls into.

This dynamic mirrors patterns seen in other areas where disclosed risks get quietly absorbed into fine print. If you have read our piece on the neural implant myth BCI companies will not correct, the structure will feel familiar: a company-controlled narrative, a technically accurate but incomplete reassurance, and a public that mostly never asks the follow-up question.

Warning: Do not download firmware updates from third-party sites, forums, or aggregator pages. The only safe source is your manufacturer’s official domain. Malicious firmware disguised as an update is a documented attack vector. If the URL does not match the manufacturer’s primary website exactly, close the tab.

The Honest Pros and Cons of Your Current Position

There is a version of this story where the news is not entirely grim.

The pro is that UEFI vulnerabilities, while serious, generally require either physical access to a device or an already-compromised operating system to exploit. This is not a drive-by web attack for most users. The threat model is real, but it is not the same as a zero-click remote exploit.

The con is that this comfort has limits. State-sponsored threat actors, sophisticated ransomware groups, and persistent access campaigns specifically target firmware because of its durability. If your device is used for sensitive legal work, financial access, or anything that would make you a worthwhile target, the calculus changes. The 2023 Binarly data also showed that many affected devices belong to enterprise fleets where IT teams assume vendor patches are automatic. They are not always.

The second con is end-of-support timelines. A device declared end-of-support by its manufacturer may be completely current on OS patches and completely frozen on firmware. There is no automated alert. There is no pop-up. The vulnerability simply sits there. This is not unlike how some financial exposures accumulate quietly until the window to act has already closed, a pattern that tends to catch people exactly when they can least afford the surprise.

Pro Tip: On Windows, press Win+R, type msinfo32, and hit Enter. Look for “BIOS Version/Date” in the System Summary. Write that version number down. On macOS, click the Apple menu, select “About This Mac,” then “System Report,” and look under Hardware Overview for “Boot ROM Version.” With both numbers in hand, go to your manufacturer’s official support page, search your exact model number, and compare what you have against what is currently listed. If a newer version exists and your model is still supported, you have a firmware update waiting. If your model is end-of-support and the vulnerability applies, you now have the information you need to make a real decision about how you use that machine.

Do you know whether your device manufacturer still issues firmware updates for your model? Most people have never asked.

Your Next 3 Steps

Step 1. Open System Information right now, before you close this tab. On Windows, press Win+R, type msinfo32, and press Enter. Find “BIOS Version/Date” in the left panel summary. On macOS, go to Apple menu, “About This Mac,” “System Report,” then Hardware Overview and locate “Boot ROM Version.” Write the exact version string and date somewhere you will not lose it.

Step 2. Go to your device manufacturer’s official support or drivers page, not a third-party site, not a forum link. Search your exact model number and look for a BIOS or firmware section. Compare the version listed there against the version you just wrote down. If the support page shows a newer release date than your current firmware date, a real update exists and is waiting for you to install it.

Step 3. If your model is end-of-support and the Binarly 2025 or 2023 vulnerability data flags your hardware, treat that machine accordingly. Stop using it for banking, legal files, or any account with financial access. Document the model, the known vulnerability, and the manufacturer’s end-of-support date in a simple text file. Set a calendar reminder for 90 days out to recheck, because new patches occasionally appear even for older hardware after major public disclosures. And seriously evaluate whether that device deserves a replacement, not because it stopped working, but because the foundation it runs on has been left permanently open.

Here is what this actually means for you: your operating system is not your security. It is one layer of it. The layer underneath it has been quietly carrying risk that most manufacturers hoped you would never think to check. Now you have.