CVE-2025-48516

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to abuse the unprotected PMIC interface to create a permanent denial of service condition or affect the integrity of the memory module.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-276

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 15, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-485174.6Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES gues CVE-2025-485186.9Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integ CVE-2025-485198.5An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or w CVE-2025-48523.4A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknow CVE-2025-485206.9An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out-CVE-2025-485216.9Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condit CVE-2025-485227.8In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code.CVE-2025-485237.8In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This CVE-2025-485245.5In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local d CVE-2025-485257.8In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to CVE-2025-485264.0In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserActivity in another prof CVE-2025-485276.2In multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the code. This could lead t