An improper input validation flaw in the AMD OverDrive (AOD) System Management Mode (SMM) module allows a privileged attacker to read memory beyond the intended bounds. The vulnerability could expose sensitive data stored in those memory regions, but it does not enable code execution or denial of service. The flaw is rated with a CVSS score of 4.6, reflecting a moderate impact for confidentiality only.

Affected products include AMD EPYC 4004 and 4005 processors, all variants of the AMD Ryzen 6000‑ through 9000‑Series Desktop and Mobile processors, associated Radeon graphics chips, the Ryzen Threadripper and Threadripper PRO 7000 lines, the Ryzen AI 300 Series, the Ryzen Embedded 7000‑ through 9000‑Series, and the Ryzen Embedded V3000 Series. No specific firmware or BIOS version is indicated in the advisory, so all releases of these processors that include the AOD SMM module are potentially impacted.

The vulnerability is accessible only to a privileged intruder with write access to the SMM environment, which typically requires either physical access or root/administrator privileges. The CVSS base score of 4.6 indicates low to moderate severity, and the EPSS score is not available, suggesting limited publicly known exploitation attempts. The issue is not listed in the CISA KEV catalogue. The attack vector is, therefore, the local privileged domain, and the risk to systems remains limited unless an attacker can elevate privileges to the SMM level.