This vulnerability (CVE-2026-0438) affects the SMM handler in AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics. It involves a call to a function pointer from an untrusted control sphere, which can lead to execution of attacker-controlled code in SMM. The attack scenario requires a highly privileged attacker, active user interaction, and complex preconditions. The vulnerability could impact system confidentiality, integrity, and availability. The CVSS 4.0 vector indicates the attack requires physical presence (AV:P), high attack complexity (AC:H), privileges (PR:H), user interaction (UI:A), and results in high impact on confidentiality, integrity, and availability (C:H, I:H, A:H). No patch or remediation level has been published by AMD yet.

If exploited, this vulnerability could allow a highly privileged attacker to execute arbitrary code within the System Management Mode, potentially compromising the system's confidentiality, integrity, and availability. However, exploitation requires active user interaction and is of high complexity, limiting the likelihood of successful attacks. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation or patch has been published by AMD, monitor AMD's advisories for updates. Until a fix is available, limit exposure by restricting access to highly privileged accounts and minimizing opportunities for active user interaction that could trigger the vulnerability.