Access Control Vulnerability in AMD Secure Encrypted Virtualization Firmware
CVE-2025-54504

5.9MEDIUM

Key Information:

Vendor

Amd
Status
Amd Epyc™ 9005 Series Processors
Amd Epyc™ Embedded 9005 Series Processors
Vendor
CVE Published:
10 November 2026

What is CVE-2025-54504?

The AMD Secure Encrypted Virtualization (SEV) firmware exhibits insufficient granularity of access control, which may permit a malicious actor with administrative rights to write to a secure region utilized by SEV-Encrypted State (SEV-ES). This flaw poses significant risks, including potential integrity breaches, as it undermines the fundamental security assurances expected from the SEV framework. Proper mitigation strategies and timely updates are essential to safeguard environments impacted by this vulnerability.

Affected Version(s)

AMD EPYC™ 9005 Series Processors TurinPI_1.0.0.A

AMD EPYC™ Embedded 9005 Series Processors EmbeddedTurinPI_SP5_1004

References

https://www.amd.com/en/resources/product-security/bulleti...

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.