CVE-2025-54504: Medium severity AMD Secure Encrypted Virtualization (SEV) firmware vulnerability

Published Nov 10, 2026

Updated

Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity.

Affected Software

1 affected component

AMD Secure Encrypted Virtualization (SEV) firmware

Event History

Nov 10, 2026

CVE Published

via MITRE·09:43 PM

Data Sourced

via MITRE·09:43 PM

DescriptionWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems using AMD Secure Encrypted Virtualization firmware are in scope. Exploitation requires administrative privileges, so an attacker must already have high-level access to the affected system.

What could an attacker achieve?

An attacker with administrative privileges could write to a trusted region used by SEV-ES. This could result in loss of integrity.

Is this remotely exploitable or does it require user interaction?

The provided vector identifies local attack access and no user interaction requirement. The attacker must have administrative privileges.

CVE-2025-54504: Medium severity AMD Secure Encrypted Virtualization (SEV) firmware vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What could an attacker achieve?

Is this remotely exploitable or does it require user interaction?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What could an attacker achieve?

Is this remotely exploitable or does it require user interaction?