Skip to content
Fencer Vulns
medium 5.4

CVE-2025-48515 json

Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to over…

published 2026-02-10 8 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-207142

cvss
5.4
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 4%
public exploits
0
none known

Summary

Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potentially resulting in arbitrary code execution.

Patch / fix

  • AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics RenoirPI-FP6 1.0.0.Ed
  • AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics CezannePI-FP6_1.0.1.1c
  • AMD AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics CezannePI-FP6_1.0.1.1c
  • AMD AMD Ryzen™ 4000 Series Desktop Processors RenoirPI-FP6_1.0.0.Ec
  • AMD AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics ComboAM4v2PI_1.2.0.11
  • AMD AMD Ryzen™ Embedded V2000 Series Processors EmbeddedPI-FP6_1.0.0.D

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
8 mo ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.4 CVSS:4.0/AV:P/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 5.4 CVSS:4.0/AV:P/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 4000 Series Desktop Processors
  • AMD AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ Embedded V2000 Series Processors

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.