CVE-2025-61972 is a vulnerability in AMD EPYC™ 9004 Series Processors where NBIO registers lack lock bit protection. This flaw allows a local attacker with administrative privileges to gain arbitrary access to the System Management Network (SMN), potentially enabling arbitrary code execution in the AMD Secure Processor (ASP). Such exploitation could compromise the confidentiality and integrity of SEV-SNP guests, which are designed to provide secure virtualization environments. The vulnerability has a high CVSS 4.0 score of 8.5, reflecting its severity and impact on system security. No patch or official remediation level has been published by AMD, and no known exploits have been reported in the wild. The attack requires local privileged access and has high attack complexity.

If exploited, this vulnerability could allow a local administrator to execute arbitrary code within the AMD Secure Processor, undermining the security of SEV-SNP guests by compromising their confidentiality and integrity. This could lead to unauthorized access to sensitive data and control over secure virtualization environments. The vulnerability affects the hardware security controls of AMD EPYC™ 9004 Series Processors, impacting systems relying on these processors for secure operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided by AMD, organizations should monitor AMD's advisories for updates. Until a fix is available, restrict local administrative access to trusted personnel only and consider additional host-level security controls to limit potential exploitation.