Quick answers
- Is CVE-2025-48513 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-48513 being exploited in the wild.
- How severe is CVE-2025-48513?
- Informational severity, with a CVSS score of 6.9, published 15 May 2026.
- Which products and versions are affected?
- AMD Platform Management Framework (PMF).
- Is there a fix for CVE-2025-48513?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-48513 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2025-48513?
- Check whether you run Amd Platform Management Framework. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability classified as CWE-908 (Use of Uninitialized Resource) exists within the AMD Platform Management Framework (PMF). The flaw occurs when the framework fails to properly initialize memory resources before they are accessed or returned. A local attacker with low privileges can exploit this to leak sensitive information from kernel memory (loss of confidentiality) or potentially trigger a system crash (loss of availability). The attack requires local access but no user interaction. AMD has addressed this in security bulletin AMD-SB-4015.
Affected products
- AMD Platform Management Framework (PMF)
Timeline
- 2026-05-15: disclosed: Initial publication of the CVE record.