AMD Ryzen Processors CVE-2026-0438

Attack requires: (1) High privilege level (admin or equivalent) on the target system; (2) Physical proximity or direct local system access (AV:P); (3) High complexity conditions including specific firmware state or preconditions (AC:H/AT:P); (4) Active user interaction to trigger the vulnerable code path (UI:A); (5) The SMM handler must be invoked during normal operation, which typically occurs during power state transitions, ACPI operations, or firmware-initiated callbacks. Exploitation is limited by the requirement that the attacker cannot arbitrarily trigger SMM from user space - SMM entry is tightly controlled through specific privileged operations (e.g., SMI generation via hardware pins, ACPI methods, or authorized firmware calls). Non-default configurations or BIOS settings may further constrain the attack surface. Systems with restricted local admin access, air-gapped deployments, or those running security-hardened BIOS configurations offer some mitigation against local privilege escalation prerequisites, though a privileged attacker on-system remains fully capable.

Despite the CVSS 5.4 (moderate) score, this vulnerability carries elevated real-world risk due to its privileged execution context. The CVSS vector (AV:P/AC:H/AT:P/PR:H/UI:A) indicates attack vector requires physical proximity, high complexity, presence of preconditions, high privilege level, and active user interaction - significantly restricting exploitability in most environments. However, the impact scope is severe: successful SMM code execution allows complete system compromise at the deepest firmware level. The CVSS impact ratings (VC:H/VI:H/VA:H) confirm confidentiality, integrity, and availability impact, but are constrained to the SMM security boundary (SC:N/SI:N/SA:N indicates no scope change beyond SMM). Real-world risk depends critically on threat model: for consumer systems with single local user, risk is low; for multi-user environments or systems accessible to adversarial local admins, risk escalates significantly. The requirement for "high complexity and present preconditions" suggests non-trivial prerequisites (specific firmware state, timing, or configuration) that likely limit opportunistic exploitation. EPSS score not provided in input data. KEV status not confirmed; treat as unconfirmed active exploitation at time of analysis. Patch availability across multiple firmware revisions suggests AMD took this seriously but the abundance of version-specific patches may create deployment challenges.

A highly privileged local administrator on an AMD Ryzen system deliberately crafts a sequence of operations to populate non-SMM memory with malicious code, then triggers the SMM handler callout through a specific firmware state or timing-dependent condition (e.g., power management operation, system sleep/wake cycle, or specific BIOS configuration manipulation). The attacker may require active user interaction such as initiating system suspend or interacting with a privileged management interface. Upon SMM invocation, the handler executes the attacker-injected code within SMM context, granting complete firmware-level control before the OS regains control.