CVE-2026-0436
Awaiting Analysis Awaiting Analysis - Queue

Insufficient Parameter Sanitization in AMD Secure Processor TEE SPDM Driver

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Advanced Micro Devices Inc.

Description
Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attacker to supply malicious input, potentially resulting in loss of platform integrity, memory leakage, or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-0436
EUVD
EUVD-2026-124644

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
amd secure_processor From 1.0.0.3 (inc) to 1.0.0.8 (inc)
amd epyc_9005_series_processors 1.0.0.8
amd instinct_mi300c 1.0.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-0436 is a flaw in AMD's Secure Processor firmware where insufficient input validation in the trusted execution environment's SPDM driver allows malicious input. This could lead to loss of platform integrity, memory leakage, or denial of service if exploited by an attacker with access to affected interfaces.

Detection Guidance

Detection requires checking the AMD Secure Processor firmware version. Compare installed versions against the patched versions (TurinPI_1.0.0.8 for EPYC 9005 Series, MI300C 1.0.0.3 for Instinct MI300C). Use system management tools or BIOS/UEFI interfaces to verify firmware versions.

Impact Analysis

If exploited, this vulnerability could allow an attacker to compromise system integrity, leak sensitive memory data, or cause the system to crash. It requires local access but could impact confidentiality, availability, and integrity of the affected platform.

Mitigation Strategies

Apply the latest firmware updates provided by AMD (TurinPI_1.0.0.8 for EPYC 9005 Series, MI300C 1.0.0.3 for Instinct MI300C). Contact your OEM for BIOS updates specific to your hardware. Ensure all affected systems are updated promptly to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0436. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...