CVE-2025-54506

MediumCVSS 4.0/10Last modified Nov 12, 2026

Description

A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity.

Metrics

CVSS 4.0 4.0/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
AMD	AMD EPYC™ 9005 Series Processors	—
AMD	AMD EPYC™ Embedded 9005 Series Processors	—

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3037.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-545084.0Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attack CVE-2025-545094.0Improper access control for register interface in the Input-Output Memory Management Unit (IOMMU) could allow a privileged attacker to cause CVE-2025-54514.9A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a rem CVE-2025-545105.9A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with administrative privilege CVE-2025-545115.3Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a functi CVE-2025-545127.0A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, CVE-2025-545144.8Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a CVE-2025-545151.0The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interfa CVE-2025-545178.5Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.CVE-2025-545187.0Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instruction CVE-2025-545197.3A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary co CVE-2025-54526.6A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to pot