Executive brief
A vulnerability in AMD processor firmware could allow a highly privileged attacker with physical access to the hardware to execute unauthorized code at the highest level of system privilege. This occurs within the System Management Mode (SMM), a protected area of the processor used for low-level hardware control. If exploited, an attacker could potentially gain full control over the system, bypassing security protections to access sensitive data or disrupt operations.
Technical details
This vulnerability involves an SMM Callout where a System Management Mode (SMM) handler executes code located in non-SMM or untrusted memory regions. An attacker with high privileges and physical access could exploit this by placing malicious code in the target memory location before the callout occurs. The attack requires high complexity, specific preconditions, and active user interaction. Successful exploitation allows for arbitrary code execution within SMM, which operates with higher privileges than the operating system kernel or hypervisor, leading to a total compromise of confidentiality, integrity, and availability.
Affected products
- AMD Processor Firmware
Timeline
- 2026-05-15: disclosed: Initial NVD publication date