CVE-2025-0037

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow access to isolated or protected memory spaces, resulting in the loss of integrity and confidentiality.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-00386.6In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow acces CVE-2025-00405.3Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with phys CVE-2025-00414.6Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user CVE-2025-00444.8An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial los CVE-2025-00456.9Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, pot CVE-2025-00467.0Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.CVE-2025-00494.3When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes th CVE-2025-00505.9Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valha CVE-2025-00518.7Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.CVE-2025-00528.3Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.CVE-2025-00535.3SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a CVE-2025-00545.4SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The