Read the docs
TI-2025-21327 Aliases CVE-2025-29950GHSA-9q65-prr3-6hh3

Improper input validation in system management mode (SMM) could allow a privileged…

Priority LOW 32CWE-1274Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00163 5th percentileScored 2026-11-07
Fix Fixed AMD EPYC™ 9004 Series Processors (AMD): GenoaPI 1.0.0.GAMD EPYC™ 7003 Series Processors (AMD): MilanPI 1.0.0.H+18 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDAMD EPYC™ 9004 Series Processors—GenoaPI 1.0.0.GPatch availableCNA
AMDAMD EPYC™ 7003 Series Processors—MilanPI 1.0.0.HPatch availableCNA
AMDAMD EPYC™ 7002 Series Processors—RomePI 1.0.0.NPatch availableCNA
AMDAMD EPYC™ 7001 Series Processors—NaplesPI 1.0.0.RPatch availableCNA
AMDAMD EPYC™ 9005 Series Processors—TurinPI 1.0.0.6Patch availableCNA
AMDAMD Instinct™ MI300A—MI300A 1.0.0.BPatch availableCNA
AMDAMD EPYC™ 9V64H Processor—MI300C 1.0.0.2Patch availableCNA
AMDAMD Ryzen™ Threadripper™ PRO 3000WX Processors—ChagallWSPI-sWRX8 1.0.0.C, CastlePeakWSPI-sWRX8 1.0.0.IPatch availableCNA
AMDAMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors—ChagallWSPI-sWRX8 1.0.0.CPatch availableCNA
AMDAMD Ryzen™ Threadripper™ 7000 Processors—StormPeakPI-SP6_1.0.0.1l, ShimadaPeakPI-SP6_1.0.0.1Patch availableCNA
AMDAMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors—StormPeakPI-SP6_1.1.0.0j, ShimadaPeakPI-SP6_1.0.0.1Patch availableCNA
AMDAMD Ryzen™ Threadripper™ 9000 Processors—ShimadaPeakPI-SP6_1.0.0.1Patch availableCNA
AMDAMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors—ShimadaPeakPI-SP6_1.0.0.1Patch availableCNA
AMDAMD EPYC™ Embedded 7003 Series Processors—EmbMilanPI-SP3 v9 1.0.0.CPatch availableCNA
AMDAMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")—EmbGenoaPI-SP5 1.0.0.BPatch availableCNA
AMDAMD EPYC™ Embedded 7002 Series Processors—EmbRomePI-SP3 1.0.0.FPatch availableCNA
AMDAMD EPYC™ Embedded 3000 Series Processors—SnowyOwl_SP4_SP4r2.1.1.0.HPatch availableCNA
AMDAMD EPYC™ Embedded 9005 Series Processors—EmbTurinPI-SP5_1.0.0.1Patch availableCNA
AMDAMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")—EmbGenoaPI-SP5 1.0.0.BPatch availableCNA
AMDAMD EPYC™ Embedded 8004 Series Processors—EmbGenoaPI-SP5 1.0.0.BPatch availableCNA
  • AMD EPYC™ 9004 Series Processors VendorAMD Affected — Fixed in GenoaPI 1.0.0.G Patch available CNA
  • AMD EPYC™ 7003 Series Processors VendorAMD Affected — Fixed in MilanPI 1.0.0.H Patch available CNA
  • AMD EPYC™ 7002 Series Processors VendorAMD Affected — Fixed in RomePI 1.0.0.N Patch available CNA
  • AMD EPYC™ 7001 Series Processors VendorAMD Affected — Fixed in NaplesPI 1.0.0.R Patch available CNA
  • AMD EPYC™ 9005 Series Processors VendorAMD Affected — Fixed in TurinPI 1.0.0.6 Patch available CNA
  • AMD Instinct™ MI300A VendorAMD Affected — Fixed in MI300A 1.0.0.B Patch available CNA
  • AMD EPYC™ 9V64H Processor VendorAMD Affected — Fixed in MI300C 1.0.0.2 Patch available CNA
  • AMD Ryzen™ Threadripper™ PRO 3000WX Processors VendorAMD Affected — Fixed in ChagallWSPI-sWRX8 1.0.0.C, CastlePeakWSPI-sWRX8 1.0.0.I Patch available CNA
  • AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors VendorAMD Affected — Fixed in ChagallWSPI-sWRX8 1.0.0.C Patch available CNA
  • AMD Ryzen™ Threadripper™ 7000 Processors VendorAMD Affected — Fixed in StormPeakPI-SP6_1.0.0.1l, ShimadaPeakPI-SP6_1.0.0.1 Patch available CNA
  • AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors VendorAMD Affected — Fixed in StormPeakPI-SP6_1.1.0.0j, ShimadaPeakPI-SP6_1.0.0.1 Patch available CNA
  • AMD Ryzen™ Threadripper™ 9000 Processors VendorAMD Affected — Fixed in ShimadaPeakPI-SP6_1.0.0.1 Patch available CNA
  • AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors VendorAMD Affected — Fixed in ShimadaPeakPI-SP6_1.0.0.1 Patch available CNA
  • AMD EPYC™ Embedded 7003 Series Processors VendorAMD Affected — Fixed in EmbMilanPI-SP3 v9 1.0.0.C Patch available CNA
  • AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa") VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.B Patch available CNA
  • AMD EPYC™ Embedded 7002 Series Processors VendorAMD Affected — Fixed in EmbRomePI-SP3 1.0.0.F Patch available CNA
  • AMD EPYC™ Embedded 3000 Series Processors VendorAMD Affected — Fixed in SnowyOwl_SP4_SP4r2.1.1.0.H Patch available CNA
  • AMD EPYC™ Embedded 9005 Series Processors VendorAMD Affected — Fixed in EmbTurinPI-SP5_1.0.0.1 Patch available CNA
  • AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo") VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.B Patch available CNA
  • AMD EPYC™ Embedded 8004 Series Processors VendorAMD Affected — Fixed in EmbGenoaPI-SP5 1.0.0.B Patch available CNA

Remediation

  • Fix · CNA AMD EPYC™ 9004 Series Processors (AMD) Fixed in GenoaPI 1.0.0.G
  • Fix · CNA AMD EPYC™ 7003 Series Processors (AMD) Fixed in MilanPI 1.0.0.H
  • Fix · CNA AMD EPYC™ 7002 Series Processors (AMD) Fixed in RomePI 1.0.0.N
  • Fix · CNA AMD EPYC™ 7001 Series Processors (AMD) Fixed in NaplesPI 1.0.0.R
  • Fix · CNA AMD EPYC™ 9005 Series Processors (AMD) Fixed in TurinPI 1.0.0.6
  • Fix · CNA AMD Instinct™ MI300A (AMD) Fixed in MI300A 1.0.0.B
  • Fix · CNA AMD EPYC™ 9V64H Processor (AMD) Fixed in MI300C 1.0.0.2
  • Fix · CNA AMD Ryzen™ Threadripper™ PRO 3000WX Processors (AMD) Fixed in ChagallWSPI-sWRX8 1.0.0.C, CastlePeakWSPI-sWRX8 1.0.0.I
  • Fix · CNA AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors (AMD) Fixed in ChagallWSPI-sWRX8 1.0.0.C
  • Fix · CNA AMD Ryzen™ Threadripper™ 7000 Processors (AMD) Fixed in StormPeakPI-SP6_1.0.0.1l, ShimadaPeakPI-SP6_1.0.0.1
  • Fix · CNA AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors (AMD) Fixed in StormPeakPI-SP6_1.1.0.0j, ShimadaPeakPI-SP6_1.0.0.1
  • Fix · CNA AMD Ryzen™ Threadripper™ 9000 Processors (AMD) Fixed in ShimadaPeakPI-SP6_1.0.0.1
  • Fix · CNA AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors (AMD) Fixed in ShimadaPeakPI-SP6_1.0.0.1
  • Fix · CNA AMD EPYC™ Embedded 7003 Series Processors (AMD) Fixed in EmbMilanPI-SP3 v9 1.0.0.C
  • Fix · CNA AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa") (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.B
  • Fix · CNA AMD EPYC™ Embedded 7002 Series Processors (AMD) Fixed in EmbRomePI-SP3 1.0.0.F
  • Fix · CNA AMD EPYC™ Embedded 3000 Series Processors (AMD) Fixed in SnowyOwl_SP4_SP4r2.1.1.0.H
  • Fix · CNA AMD EPYC™ Embedded 9005 Series Processors (AMD) Fixed in EmbTurinPI-SP5_1.0.0.1
  • Fix · CNA AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo") (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.B
  • Fix · CNA AMD EPYC™ Embedded 8004 Series Processors (AMD) Fixed in EmbGenoaPI-SP5 1.0.0.B

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-29950
  2. 2026-10-03 Alias added: GHSA-9q65-prr3-6hh3

References

Other 2

  • TI-2026-36341 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization CVSS 4.0CRITICAL 9.2
  • TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
  • TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
  • TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
  • TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
  • TI-2022-07839 Improper access control in System Management Mode (SMM) may allow an attacker to write to… CVSS 3.1CRITICAL 9.8
See all 508 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences