CVE-2025-61972 is a vulnerability in AMD EPYC™ 9004 Series Processors characterized by missing lock bit protection on NBIO registers. This flaw permits a local attacker with administrative privileges to access the System Management Network (SMN) arbitrarily. Exploiting this access can result in arbitrary code execution within the AMD Secure Processor (ASP), undermining the confidentiality and integrity guarantees of SEV-SNP guests. The vulnerability is rated high severity with a CVSS 4.0 score of 8.5, reflecting its potential impact and complexity. No patch or official remediation level has been disclosed by AMD, and no exploits have been observed in the wild.

A local administrator could exploit this vulnerability to gain unauthorized access to the System Management Network, enabling arbitrary code execution in the AMD Secure Processor. This could lead to a breach of the confidentiality and integrity of SEV-SNP guests running on affected processors. The impact is significant given the role of the AMD Secure Processor in protecting sensitive operations and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, organizations should monitor AMD's advisories for updates. Until a fix is available, restricting local administrative access and applying defense-in-depth controls around systems using AMD EPYC™ 9004 Series Processors may reduce risk.