AMD Platform Management Framework CVE-2025-48513

Q: What is the CVSS score of CVE-2025-48513?

CVE-2025-48513 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209870 MEDIUM

Use of Uninitialized Resource (CWE-908)

2026-05-15 AMD

GHSA-p7c5-wcmh-3ww2

Information Disclosure Amd

6.9

CVSS 4.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 03:32 vuln.today

CVSS changed

May 15, 2026 - 03:22 NVD

6.9 (MEDIUM)

CVE Published

May 15, 2026 - 01:51 nvd

MEDIUM 6.9

DescriptionNVD

Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memory resulting in loss of confidentiality or availability.

AnalysisAI

Uninitialized kernel memory within AMD's Platform Management Framework (PMF) can be read by local authenticated attackers, resulting in information disclosure or availability impact. This affects AMD Ryzen processors across multiple generations (6000, 7035, 7040, 8040 series and Z1/Embedded 8000) where PMF is present. The vulnerability requires local access and authenticated user privileges but does not require user interaction, making it exploitable by any local user with login credentials.

Technical ContextAI

The AMD Platform Management Framework is a low-level firmware/driver component running on AMD Ryzen processors that handles platform-level operations and resource management. The vulnerability stems from CWE-908 (Use of Uninitialized Resource), a memory safety flaw where kernel memory buffers are not properly initialized before use. When PMF processes certain operations, it may expose uninitialized kernel memory regions to authenticated local users, allowing information disclosure. This affects multiple processor generations spanning Rembrandt (6000, 7035 series), Phoenix (7040), Hawk Point (8040), Z1, and Embedded 8000 variants. The flaw is in the PMF component itself rather than the CPU microarchitecture, making it a firmware/driver-level vulnerability affecting systems running affected processor generations.

RemediationAI

Apply the Platform Management Framework firmware/driver update provided by AMD via Security Bulletin AMD-SB-4015 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4015.html). The specific patched firmware version number is not provided in available data-consult the AMD advisory for exact PMF version requirements for your processor series. Interim mitigation: Restrict local system access to trusted users only by disabling unnecessary user accounts and enforcing strong authentication mechanisms (multi-factor authentication if available on your system). For cloud/enterprise environments, implement mandatory access controls and container isolation to prevent lateral movement between tenant environments. Note that firmware updates typically require system restart and may have subtle behavioral impacts on low-level platform management, so test in non-production environments first. Organizations with systems running affected Ryzen generations should prioritize this patch for multi-user systems and cloud deployments where unauthorized local users could exploit this flaw.