Executive brief
A security vulnerability exists in the firmware of certain AMD processors that manage high-privilege system operations. A highly privileged attacker, such as one with administrative access to the operating system, could exploit this flaw to read or write to protected areas of system memory. This could lead to a compromise of sensitive data or the integrity of the system's core security functions.
Technical details
This vulnerability is characterized as an improper input validation flaw within the System Management Mode (SMM) communications buffer of AMD processors. A local attacker with high privileges (such as Ring 0/Kernel access) can provide crafted input to the SMM handler, leading to an out-of-bounds (OOB) read or write within the Top of Memory Segment (TSEG). This memory region is typically reserved for SMM to protect sensitive firmware data from the operating system. Successful exploitation could allow the attacker to bypass hardware-level memory protections, potentially leading to arbitrary code execution within SMM or the theft of secrets stored in protected memory. Users should apply firmware/BIOS updates provided by their original equipment manufacturers (OEMs).
Affected products
- AMD Processors
Timeline
- 2026-05-19: disclosed