CVE-2025-54502
Received Received - Intake
Privilege Escalation via Boot Service Misuse in AMD APCB SMM Driver

Publication date: 2026-04-16

Last updated on: 2026-04-16

Assigner: Advanced Micro Devices Inc.

Description
Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation potentially resulting in arbitrary code execution.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-16
Last Modified
2026-04-16
Generated
2026-06-16
AI Q&A
2026-04-16
EPSS Evaluated
2026-06-15
NVD
CVE-2025-54502
EUVD
EUVD-2025-209508
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
amd platform_configuration_blob *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves the incorrect use of a boot service in the AMD Platform Configuration Blob (APCB) System Management Mode (SMM) driver. It could allow a privileged attacker who already has local access with Ring 0 privileges to escalate their privileges further, potentially enabling them to execute arbitrary code.

Impact Analysis

If exploited, this vulnerability could allow an attacker with existing high-level local access to gain even greater privileges on the affected system. This privilege escalation could lead to arbitrary code execution, which might compromise system integrity, confidentiality, and availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-54502. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart