Improper Access Control in AMD Secure Encrypted Virtualization Firmware
CVE-2025-0027

5.9MEDIUM

Key Information:

Vendor

Amd
Status
Amd Epyc™ 9004 Series Processors
Amd Epyc™ 7003 Series Processors
Amd Epyc™ 9005 Series Processors
Amd Epyc™ 8004 Series Processors
Vendor
CVE Published:
10 November 2026

What is CVE-2025-0027?

This vulnerability stems from improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware. It may allow a malicious hypervisor to bypass critical Reverse Map Table (RMP) protections. The risks associated with this flaw could lead to unauthorized access to Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory, undermining the integrity and security of virtualized environments.

Affected Version(s)

AMD EPYC™ 7003 Series Processors MilanPI-SP3_1.0.0.K

AMD EPYC™ 8004 Series Processors GenoaPI_1.0.0.J

AMD EPYC™ 9004 Series Processors GenoaPI_1.0.0.J

References

https://www.amd.com/en/resources/product-security/bulleti...

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.