Quick answers
- Is CVE-2025-54509 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-54509 being exploited in the wild.
- How severe is CVE-2025-54509?
- Informational severity, with a CVSS score of 5.1, published 9 June 2026.
- Which products and versions are affected?
- AMD IOMMU.
- Is there a fix for CVE-2025-54509?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-54509 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2025-54509?
- Check whether you run Amd IOMMU. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is classified as CWE-1262 (Improper Access Control for Register Interface) within the AMD Input-Output Memory Management Unit (IOMMU). A local attacker with high privileges (PR:H) can exploit improper access controls on the register interface to trigger non-coherent memory accesses by the AMD Secure Processor (ASP). This condition can be leveraged to bypass integrity protections enforced by the ASP. The attack requires specific architectural conditions (AT:P) but does not require user interaction. Mitigation typically involves firmware or BIOS updates from the original equipment manufacturer (OEM).
Affected products
- AMD IOMMU
Timeline
- 2026-06-09: disclosed: Initial disclosure by AMD
- 2026-06-09: advisory: NVD record published