CVE-2026-0435

MediumCVSS 6.0/10Last modified Nov 13, 2026

Description

Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to swap out a guest device without the guest's knowledge, potentially resulting in a loss of confidentiality and integrity.

Metrics

CVSS 4.0 6.0/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-672

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-04366.9Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an attacke CVE-2026-04385.4A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker cou CVE-2026-04544.6An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrupt global firmwa CVE-2026-04555.9The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthoriz CVE-2026-04601.0Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, poten CVE-2026-04617.5Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded CVE-2026-04655.6A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potential CVE-2026-04665.5Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potential CVE-2026-04706.8Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability.CVE-2026-04806.0Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to for CVE-2026-04819.2Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized ch CVE-2026-04825.4In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow craf