Technical impact
The vulnerability is an out‑of‑bounds read in the AMD Platform Management Framework (PMF). It allows an attacker to read data from arbitrary memory addresses, which can expose sensitive information or cause a denial of service by corrupting system state. The weakness is classified as CWE‑125, an untrusted control of buffer or array bounds.
Affected Systems
Affected are AMD Ryzen 6000, 7035, 7040, 8040, and Embedded 8000 series processors running the Platform Management Framework firmware as supplied by AMD. Specific model names include Rembrandt, Rembrandt R, Phoenix, Hawk Point, and the Embedded 8000 series.
Risk and Exploitability
The CVSS score of 5.8 indicates moderate severity, and with no EPSS data, the likelihood of exploitation remains uncertain. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers would need privileged access to the firmware or a way to interact with the PMF subsystem, implying the likely attack vector involves local privileged or firmware‑level compromise.
