Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microc…

published 2025-09-06 14 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-27086

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits: 0; none known

Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially resulting in loss of integrity of x86 instruction execution.

Patch / fix

fixed in 7

AMD AMD EPYC™ 9005 Series Processors TurinPI 1.0.0.4
AMD AMD Ryzen™ AI 300 Series Processors StrixKrackanPI-FP8_1.1.0.1b
AMD AMD Ryzen™ 9000 Series Desktop Processors ComboAM5PI 1.2.0.3c
AMD AMD Ryzen™ 9000HX Series Processors FireRangeFL1PI 1.0.0.0a
AMD AMD Ryzen™ Al Max+ StrixHaloPI-FP11_1.0.0.1
AMD AMD Ryzen™ Threadripper™ 9000 series ShimadaPeakPI-SP6 1.0.0.1
AMD AMD EPYC™ Embedded 9000 Series Processors Embturin PI 1.0.0.0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 14 mo ago (2025-09-09)

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected products

AMD AMD EPYC™ 9005 Series Processors
AMD AMD Ryzen™ AI 300 Series Processors
AMD AMD Ryzen™ 9000 Series Desktop Processors
AMD AMD Ryzen™ 9000HX Series Processors
AMD AMD Ryzen™ Al Max+
AMD AMD Ryzen™ Threadripper™ 9000 series
AMD AMD EPYC™ Embedded 9000 Series Processors

Classification

Weakness

CWE-459 Incomplete Cleanup

References

Sources

CVE List CVE-2025-0032
NVD CVE-2025-0032

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary