Which versions of AMD Processors are affected by CVE-2025-54502?

CVE-2025-54502 affects the AMD Platform Configuration Blob driver in AGESA firmware across the complete modern AMD product line-EPYC servers, Ryzen consumer systems, Threadripper workstations, and…

How to fix or mitigate CVE-2025-54502?

Within 24 hours, inventory all AMD EPYC, Ryzen, Threadripper, and Instinct MI300 systems and document their AGESA firmware versions to establish baseline exposure. Within 7 days, review and tighten controls on Ring 0 / kernel-level code execution to only trusted, verified processes; enable Secure Boot and hardware-supported SMM protection features if available in BIOS/UEFI settings; and establish firmware integrity monitoring where possible. Within 30 days, establish continuous monitoring of AMD security advisories and the CISA KEV database for patch release, develop and test a firmware update deployment plan to enable rapid patching when available, and assess whether additional hardware-level security monitoring or firmware isolation controls can reduce blast radius until patching is possible.

AMD Processors CVE-2025-54502

Q: What is the CVSS score of CVE-2025-54502?

CVE-2025-54502 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209508 HIGH

Exposure of Resource to Wrong Sphere (CWE-668)

2026-04-16 AMD

GHSA-p7qm-4248-g65p

7.1

CVSS 4.0 · Vendor: AMD

Severity by source

Vendor (AMD) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Local Ring 0 precondition gives PR:H and the difficulty of subverting SMM gives AC:H; total SMM compromise yields C/I/A:H, with S:U kept to match AMD's SC/SI/SA:N rating.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (AMD).

CVSS VectorVendor: AMD

CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:26 vuln.today

CVSS changed

Apr 16, 2026 - 20:22 NVD

7.1 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 19:45 euvd

EUVD-2025-209508

CVE Published

Apr 16, 2026 - 18:46 nvd

HIGH 7.1

DescriptionCVE.org

Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation potentially resulting in arbitrary code execution.

AnalysisAI

Local privilege escalation in the AMD Platform Configuration Blob (APCB) SMM driver, shipped in AGESA firmware across nearly the entire modern AMD EPYC, Ryzen, Threadripper, and Instinct MI300 line, lets a Ring 0 attacker escalate into System Management Mode (SMM) and potentially run arbitrary code below the operating system. The flaw stems from the SMM driver improperly invoking UEFI boot services, and AMD-reported it with a CVSS 4.0 base of 7.1; there is no public exploit identified at time of analysis and EPSS is negligible at 0.01%. Because SMM code runs at a higher trust level than the OS kernel, successful exploitation can undermine firmware integrity and any SMM-based security guarantees.

Technical ContextAI

System Management Mode (SMM) is the most privileged x86 execution environment, entered via System Management Interrupt (SMI) and running from protected SMRAM outside the view of the OS and hypervisor. The APCB is AMD's Platform Configuration Blob, a firmware data structure holding memory and platform settings; its SMM driver is delivered as part of AGESA reference firmware baked into OEM UEFI images. The root cause maps to CWE-668 (Exposure of Resource to Wrong Sphere): the driver incorrectly uses UEFI Boot Services routines from within SMM. Boot Services are only valid before ExitBootServices() and must not be referenced by a runtime SMM handler, so calling into freed or relocated boot-time code/data at SMI time gives a Ring 0 caller a path to redirect execution or corrupt state inside the SMM sphere. The CPE list confirms breadth across AMD EPYC 7002/7003/8004/9004/9005 server, Ryzen 3000-9000 desktop/mobile, Threadripper/Threadripper PRO, embedded, and Instinct MI300A parts.

RemediationAI

Apply the OEM/motherboard BIOS or platform firmware update that incorporates the fixed AGESA build for your specific processor, as enumerated in AMD bulletin AMD-SB-7054 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7054.html) - Vendor-released patch examples include GenoaPI_1.0.0.H for EPYC 9004, TurinPI-SP5_1.0.0.9 for EPYC 9005, MilanPI-SP3_1.0.0.J for EPYC 7003, ComboAM5PI 1.2.0.3h for Ryzen 7000/9000 desktop, PhoenixPI-FP8-FP7_1.2.0.0f for Ryzen 8040 mobile, and MI300A 1.0.0.C for Instinct MI300A; because these ship inside system BIOS, obtain the release from your server/board OEM rather than AMD directly. There is no software-only workaround for an SMM firmware flaw, so compensating controls focus on limiting who can reach Ring 0: enforce Secure Boot and signed-kernel-module policies to raise the bar for gaining kernel-level code execution, restrict physical and administrative access to affected hosts, and enable/verify SMM protections such as SMM_Code_Chk_En and BIOS write protection where supported (trade-off: these do not remediate the driver defect and only reduce the pool of attackers who could pre-position at Ring 0). For multi-tenant or bare-metal-leased hardware, prioritize firmware rollout and consider host attestation. Cross-references: https://vuldb.com/vuln/357958 and Red Hat tracking at https://access.redhat.com/security/cve/CVE-2025-54502.