CVE-2024-36344

MediumCVSS 6.9/10Last modified Nov 13, 2026

Description

Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the Trusted Execution Environment (TEE) interface or Trusted Application (TA) to cause an out-of-bounds write, potentially resulting in a loss of platform integrity or denial of service.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-191

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2024

CVE-2024-363454.6Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out CVE-2024-363466.0Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input da CVE-2024-363476.4Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malic CVE-2024-363483.8A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMI CVE-2024-363493.8A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, pote CVE-2024-36354.8The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users CVE-2024-363505.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting i CVE-2024-363528.4Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to a CVE-2024-363536.5Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potential CVE-2024-363547.5Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys CVE-2024-363557.0Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (s CVE-2024-363575.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in th