CVE-2024-36355

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (sleep) wake up, potentially resulting in arbitrary code execution.

Metrics

CVSS 4.0 7.0/10CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

VendorProductVersions
AMDAMD EPYC™ 9004 Series Processors—
AMDAMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors—
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors—
AMDAMD Ryzen™ Z1 Series Processors—
AMDAMD Ryzen™ 9000 Series Desktop Processors—
AMDAMD Ryzen™ 7000 Series Desktop Processors—
AMDAMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 3000 Series Desktop Processors—
AMDAMD Ryzen™ 8000 Series Desktop Processors—
AMDAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ Threadripper™ 7000 processor—
AMDAMD Ryzen™ Threadripper™ PRO 7000 WX-Series processors—
AMDAMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 6000 Series Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 8000 Series Desktop—
AMDAMD Ryzen™ 7020 Series Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 4000 Series Desktop Processors—
AMDAMD Ryzen™ 5000 Series Desktop Processors—
AMDAMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors—
AMDAMD Ryzen™ Z2 Series Processors—
AMDAMD Ryzen™ Z2 Series Processors Go—
AMDAMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")—
AMDAMD Ryzen™ Embedded R1000 Series Processors—
AMDAMD Ryzen™ Embedded R2000 Series Processors—
AMDAMD Ryzen™ Embedded 5000 Series Processors—
AMDAMD Ryzen™ Embedded 7000 Series Processors—
AMDAMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Raven Ridge")—
AMDAMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Picasso")—
AMDAMD Ryzen™ Embedded V2000 Series Processors—
AMDAMD Ryzen™ Embedded V3000 Series Processors—
AMDAMD Ryzen™ Embedded 8000 Series Processors—

References

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-363575.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in thCVE-2024-363587.8A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate priCVE-2024-363595.4A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to esCVE-2024-36365.4The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high priCVE-2024-363609.8OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote CVE-2024-363616.8Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compiCVE-2024-363626.5In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was posCVE-2024-363635.4In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possibleCVE-2024-363646.5In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisherCVE-2024-363658.1In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agentCVE-2024-363666.1In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering oCVE-2024-363676.1In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible
CVE-2024-36355: High severity, CVSS 7.0 | Vulnix