An AMD EPYC processor can read SPD metadata from DIMMs to detect serial presence. The validation routine fails to properly check the data format, letting a malicious value reach a write path that targets guest memory. An attacker can cause corruption or loss of data in the memory space of a virtual machine, potentially undermining the integrity of guest workloads.

Manufactured in the AMD EPYC 7003 and 9004 processor families, systems that use non‑compliant or tampered DIMMs are susceptible. The vulnerability exploits the SPD handling code in the CPU firmware and does not depend on the guest OS or hypervisor.

The CVSS score of 5.3 indicates moderate severity. The exploit requires either physical access, privileged ring‑0 execution, or manipulation of the Root of Trust for BIOS update, all of which are high privilege states. EPSS is unavailable, so the likelihood of public exploitation is unknown, and the issue is not currently listed in CISA KEV. An attacker with the necessary access could overwrite guest memory and compromise data integrity; however, casual or remote attackers are unlikely to succeed without the elevated privileges noted.