CVE-2026-28248: Medium severity AMD Secure Encrypted Virtualization (SEV) firmware vulnerability

Published Nov 10, 2026

Updated

Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to potentially launch a guest whose attestation report contains an ID key digest for an ID block that doesn't match the guest's measurement resulting in loss of integrity.

Affected Software

1 affected component

AMD Secure Encrypted Virtualization (SEV) firmware

Event History

Nov 10, 2026

CVE Published

via MITRE·10:11 PM

Data Sourced

via MITRE·10:11 PM

DescriptionWeakness

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A malicious hypervisor is required. The issue affects the integrity of a guest attestation report by allowing a mismatch between the reported ID key digest and the guest measurement.

What is the security impact?

The reported impact is loss of integrity. A guest may be launched with an attestation report containing an ID key digest for an ID block that does not match that guest's measurement.

CVE-2026-28248: Medium severity AMD Secure Encrypted Virtualization (SEV) firmware vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the security impact?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the security impact?