Threat database

An out of bounds read within the AMD Platform Management Framework (PMF) could allow an attacker to trigger a read of an arbitrary memory location potentially resulting in loss of availability or confidentiality.

An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address potentially resulting in loss of confidentiality, integrity, or availability.

Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary memory pages potentially impacting integrity and availability, or allowing privilege escalation resulting in loss of confidentiality.

Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memory resulting in loss of confidentiality or availability.

CVE-2025-52540 is a high-severity vulnerability in AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics, caused by improper input validation in the AMD Platform Management Framework (PMF) Driver. This flaw allows a local attacker to perform an out-of-bounds write, which can potentially lead to privilege escalation on affected systems. The vulnerability has a CVSS 4.0 base score of 8.5, indicating significant impact if exploited. No official patch or remediation guidance has been provided by AMD as of the published date. There are no known exploits in the wild currently. Users should monitor AMD advisories for updates on mitigation or patches.

An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out-of-Bounds potentially resulting in information disclosure or a crash

CVE-2025-48519 is a high-severity vulnerability in the AMD Platform Management Framework (PMF) driver for AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics. It involves improper input validation that allows a local attacker to perform out-of-bounds read or write operations. This can potentially lead to privilege escalation on affected systems. The vulnerability is classified under CWE-787 (Out-of-bounds Write). No official patch or remediation guidance is currently available from AMD. There are no known exploits in the wild at this time.

Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, potentially resulting in a crash or denial of service

CVE-2026-0432 is a high-severity vulnerability affecting AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics. It involves incorrect default permissions in the installation directory of the AMD chipset driver, which could allow a local attacker with limited privileges to escalate their privileges and execute arbitrary code. The vulnerability has a CVSS 4.0 base score of 8.5, indicating a significant risk. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condition, potentially resulting in a loss of platform integrity or crash.

CVE-2025-48512 is a high-severity vulnerability in AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics, caused by incorrect default permissions in the installation directory of the AMD general-purpose input/output controller (GPIO). This misconfiguration could allow an attacker with limited privileges to escalate their privileges and execute arbitrary code. The vulnerability has a CVSS 4.0 score of 7.0, indicating significant risk, but no official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out-of-bounds read, potentially resulting in loss of confidentiality.

A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker could, with active user interaction and under high complexity and present preconditions, trigger execution of attacker-controlled code in SMM, potentially compromising the system’s confidentiality, integrity, and availability.

CVE-2025-62619 is a medium severity vulnerability affecting AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics. It involves missing authentication on the KVM key download endpoint, which could allow an unauthenticated attacker who knows the exposed URL to retrieve sensitive keys. This exposure may lead to loss of confidentiality of those keys. There is no vendor-provided patch or official remediation guidance available at this time. No known exploits are reported in the wild. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function).

CVE-2025-62625 is a medium severity privilege escalation vulnerability in AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics. It involves improper privilege management in the KVM key download component, allowing an attacker to swap tokens and download sensitive keys. This could lead to unauthorized access to privileged resources and loss of confidentiality. There is no confirmed patch or official remediation available at this time. No known exploits are reported in the wild.

Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentially resulting in arbitrary code execution.

Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.

CVE-2025-61972 is a high-severity vulnerability affecting AMD EPYC™ 9004 Series Processors. It involves missing lock bit protection for NBIO registers, which could allow a local attacker with administrative privileges to gain arbitrary access to the System Management Network (SMN). This access may lead to arbitrary code execution within the AMD Secure Processor (ASP) and compromise the confidentiality and integrity of SEV-SNP guests. The vulnerability has a CVSS 4.0 score of 8.5, indicating a significant security risk. No official patch or remediation guidance has been provided by AMD at this time. There are no known exploits in the wild currently reported. The vulnerability requires high attack complexity and local privileges, with no user interaction needed. The impact includes potential loss of security guarantees for virtualized environments relying on SEV-SNP protections.

Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentially resulting in loss of SEV-SNP guest integrity.

An untrusted pointer dereference in the ionic cloud driver for VMWare ESXi could allow an attacker with an unprivileged VM to read kernel memory or co-located guest VM memory, potentially resulting in loss of confidentiality or availability.