AMD EPYC Processors EUVD-2025-209577

Exploitation requires local access to a physical or virtual machine running an AMD EPYC 7001 Series or EPYC Embedded 3000 Series processor, with at least low-privilege execution rights on that host (PR:L per CVSS 4.0). The attack additionally requires specific conditions to be present (AT:P), meaning generic exploitation without precise timing setup or favorable microarchitectural state is not reliably achievable - this is inherent to transient execution side-channel attacks. Exploitation is limited to confidentiality leakage only (no integrity or availability impact). The attack is not automatable (SSVC Automatable: no), further constraining opportunistic mass exploitation. Remote exploitation is not possible; the attacker must have code execution on the target host. Virtualized environments (Xen) represent a heightened-concern scenario where a guest VM may attempt to infer host or sibling-VM data.

Multiple independent signals consistently characterize this as a low real-world risk. CVSS 4.0 score is 2.0 with attack vector local, attack requirements present (AT:P), low privileges required, and only limited vulnerable-system confidentiality impact (VC:L) with no integrity or availability impact. EPSS probability is 0.01% at the 1st percentile, meaning fewer than 1% of CVEs have a lower exploitation likelihood. CISA SSVC confirms exploitation status as none, the attack is not automatable, and technical impact is only partial. KEV status is not listed, meaning no confirmed active exploitation. The primary real-world concern is multi-tenant cloud or virtualized environments where EPYC processors run mixed-privilege workloads and strict data isolation is a security requirement. For typical enterprise server deployments with controlled local access, residual risk is minimal. The AT:P condition in CVSS 4.0 is a meaningful limiter - exploitation is not a simple fire-and-forget operation but requires specific setup conditions, consistent with the complexity inherent in transient execution attacks.

An attacker with a local low-privilege account on a server running an AMD EPYC 7001 or Embedded 3000 series CPU - such as a cloud tenant, container workload, or unprivileged OS user - crafts a sequence of floating point division operations designed to trigger transient execution paths in the FP divisor unit. By measuring timing or cache side-channel residue, the attacker infers fragments of data transiently processed by the unit, potentially belonging to a co-located process or a higher-privilege security domain. No public proof-of-concept exploit code has been identified at time of analysis.