The vulnerability arises from an observable timing discrepancy in the AMD Secure Processor (ASP), allowing a privileged attacker to perform brute‑force attacks against the hash message authentication code. By exploiting this timing leakage, an attacker can inject arbitrary message inputs, resulting in compromised data integrity without affecting confidentiality or availability.

The flaw affects AMD Ryzen 3000, 5000, Threadripper 3000, Threadripper PRO 3000WX, and Threadripper PRO 5000 WX series desktop processors.

The CVSS score of 1.8 classifies this issue as low severity; the EPSS score is not provided, and it is not listed in CISA’s KEV catalog. The attack requires privileged access to the ASP, making exploitation of this weakness unlikely on a typical system. As the impact is limited to data integrity, the overall risk to most environments is considered minimal, though high‑value targets with privileged ASP access should consider monitoring.