CVE-2025-0028

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address potentially resulting in loss of confidentiality, integrity, or availability.

Metrics

CVSS 4.0 8.3/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-252

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
AMD	AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")	—
AMD	AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")	—
AMD	AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")	—
AMD	AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")	—
AMD	AMD Ryzen™ Embedded 8000 Series Processors	—

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4015.html

Timeline

Published: May 15, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-00291.8Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA write CVE-2025-00314.6A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a diffe CVE-2025-00327.2Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microco CVE-2025-00336.0Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potential CVE-2025-00344.7Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cau CVE-2025-00357.3Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbi CVE-2025-00363.2In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause d CVE-2025-00376.6In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow ac CVE-2025-00386.6In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow acces CVE-2025-00405.3Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with phys CVE-2025-00414.6Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user CVE-2025-00437.0Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges,