CVE-2025-52537

MediumCVSS 4.0/10Last modified Nov 13, 2026

Description

Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to tamper with memory, potentially resulting in loss of guest memory integrity.

Metrics

CVSS 4.0 4.0/10CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-362

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AMDAMD EPYC™ 9005 Series Processors—
AMDAMD EPYC™ Embedded 9005 Series Processors—

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 13, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-525388.0Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resultingCVE-2025-525397.3A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interfaceCVE-2025-52546.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM alloCVE-2025-525408.5An improper input validation vulnerability within the AMD Platform Management Framework (PMF) Driver can allow a local attacker to write OutCVE-2025-525417.3A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary codCVE-2025-525437.5E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An aCVE-2025-525447.5E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floorCVE-2025-525457.5E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames andCVE-2025-525466.1E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floorCVE-2025-525477.5E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this commaCVE-2025-525484.9E3 Site Supervisor Control (firmware version < 2.31F01) contains a hidden API call in the application services that enables SSH and ShellinaCVE-2025-525499.8E3 Site Supervisor Control (firmware version < 2.31F01) generates the root linux password on each boot. An attacker can generate the root li
CVE-2025-52537: Medium severity, CVSS 4.0 | Vulnix