This vulnerability (CVE-2026-0438) involves a call to a function pointer from an untrusted control sphere within the System Management Mode (SMM) of AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics. The SMM handler may invoke code located in non-SMM memory, which is untrusted. An attacker with high privileges and active user interaction, under complex conditions, could trigger execution of arbitrary code in SMM, potentially compromising system security properties. The CVSS 4.0 vector indicates the attack requires physical proximity (AV:P), high attack complexity (AC:H), privileges (PR:H), and user interaction (UI:A), with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No patch or official remediation level has been disclosed by AMD.

If exploited, this vulnerability could allow a highly privileged attacker to execute arbitrary code within the SMM, a highly privileged execution environment, potentially compromising the system's confidentiality, integrity, and availability. However, exploitation requires active user interaction and complex preconditions, limiting the likelihood. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation has been published by AMD. Until a patch is available, users should follow AMD's security advisories and best practices for privilege management and user interaction restrictions. No specific mitigations are documented at this time.