Null Pointer Dereference in AMD Embedded SPI Flash Driver
CVE-2026-0470

6.8MEDIUM

Key Information:

Vendor

Amd
Status
Amd Epyc™ Embedded 3000 Series Processors
Amd Ryzen™ Embedded R1000 Series Processors
Amd Ryzen™ Embedded R2000 Series Processors
Amd Ryzen™ Embedded V1000 Series Processors (formerly Codenamed "raven Ridge")
Vendor
CVE Published:
11 November 2026

What is CVE-2026-0470?

The vulnerability allows a local user to exploit a null pointer dereference in the AMD Embedded SPI Flash driver, leading to potential availability disruptions. This could allow attackers to impact system performance and stability, posing risks to operations reliant on this driver. Immediate attention is required to mitigate potential exploitation.

Affected Version(s)

AMD EPYC™ Embedded 3000 Series Processors Embedded Snowyowl Chipset Driver - 8.10.28.647 (73744e)

AMD Ryzen™ Embedded R1000 Series Processors Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)

AMD Ryzen™ Embedded R2000 Series Processors Q4 2026 AMD Ryzen Emb R2K,V2K,R1K,V1K Windows Catalyst driver (73752e)

References

https://www.amd.com/en/resources/product-security/bulleti...

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.