CVE-2024-36347

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-363483.8A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMI CVE-2024-363493.8A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, pote CVE-2024-36354.8The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users CVE-2024-363505.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting i CVE-2024-363528.4Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to a CVE-2024-363536.5Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potential CVE-2024-363547.5Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys CVE-2024-363557.0Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (s CVE-2024-363575.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in th CVE-2024-363587.8A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate pri CVE-2024-363595.4A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to es CVE-2024-36365.4The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high pri