Is CVE-2024-21944 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-21944 being exploited in the wild.

How severe is CVE-2024-21944?

Medium severity, with a CVSS score of 5.3, published 10 June 2026.

Is there a fix for CVE-2024-21944?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-21944 attacked?

It is attacked with local access or with physical access, in device firmware.

Am I affected by CVE-2024-21944?

Check whether you run Amd BIOS / UEFI Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-21944: AMD BIOS improper input validation in DIMM SPD metadata

CVE-2024-21944 · Severity: medium · CVSS 5.3 · Published 2026-06-10

A vulnerability in how AMD-based systems process memory module metadata could allow an attacker with high-level system access or physical access to corrupt data within virtual machines. This issue affects the integrity of guest memory, potentially allowing an attacker to bypass isolation boundaries between the host and virtualized environments. While difficult to exploit, it poses a risk to the reliability and security of data in cloud or multi-tenant computing environments.

Vendors: Amd.

Quick answers

Is CVE-2024-21944 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-21944 being exploited in the wild.
How severe is CVE-2024-21944?: Medium severity, with a CVSS score of 5.3, published 10 June 2026.
Which products and versions are affected?: AMD BIOS / UEFI Firmware.
Is there a fix for CVE-2024-21944?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-21944 attacked?: It is attacked with local access or with physical access, in device firmware.
Am I affected by CVE-2024-21944?: Check whether you run Amd BIOS / UEFI Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from improper input validation of Serial Presence Detect (SPD) metadata, which contains configuration information for DIMM memory modules. An attacker with physical access, Ring 0 (kernel-level) privileges on a system with non-compliant hardware, or control over the BIOS Root of Trust can exploit this flaw to overwrite memory assigned to guest virtual machines. The attack requires high privileges or physical proximity and targets the integrity of the guest memory space. AMD has identified this as CWE-20 (Improper Input Validation) and issued an advisory (AMD-SB-3015) regarding the impact on guest data integrity.

Affected products

AMD BIOS / UEFI Firmware

Timeline

2026-06-10: disclosed: Initial publication of the CVE and AMD security bulletin.

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3015.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.