CVE-2025-48515

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potentially resulting in arbitrary code execution.

Metrics

CVSS 4.0 5.4/10

CVSS:4.0/AV:P/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
AMD	AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ 4000 Series Desktop Processors	—
AMD	AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics	—
AMD	AMD Ryzen™ Embedded V2000 Series Processors	—

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4013.html

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-485166.9Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to CVE-2025-485174.6Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES gues CVE-2025-485186.9Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integ CVE-2025-485198.5An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or w CVE-2025-48523.4A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknow CVE-2025-485206.9An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out-CVE-2025-485216.9Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condit CVE-2025-485227.8In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code.CVE-2025-485237.8In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This CVE-2025-485245.5In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local d CVE-2025-485257.8In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to CVE-2025-485264.0In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another prof