Vulnerability in Secure Encrypted Virtualization Firmware by AMD
CVE-2025-48504

6.8MEDIUM

Key Information:

Vendor

Amd
Status
Amd Epyc™ 9004 Series Processors
Amd Epyc™ 7003 Series Processors
Amd Epyc™ 9005 Series Processors
Amd Epyc™ 8004 Series Processors
Vendor
CVE Published:
10 November 2026

What is CVE-2025-48504?

A vulnerability exists in the Secure Encrypted Virtualization (SEV) firmware that allows a malicious hypervisor to perform operations on resources after they have expired or been released. This could potentially lead to unauthorized manipulation of metadata pages, heightening the risk of losing both confidentiality and integrity of guest memory. This exposes virtualized environments to security threats, making it essential for users to apply necessary updates and mitigations.

Affected Version(s)

AMD EPYC™ 7003 Series Processors MilanPI-SP3_1.0.0.K

AMD EPYC™ 8004 Series Processors GenoaPI_1.0.0.J

AMD EPYC™ 8005 Series Processors TurinPI_1.0.0.B

References

https://www.amd.com/en/resources/product-security/bulleti...

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.