Technical impact
An insecure default configuration in the AGESA Bootloader Firmware allows a local user to misuse the unprotected Power Management Integrated Circuit (PMIC) interface, creating a permanent denial of service or altering the integrity of DDR5 memory modules. The vulnerability is a classic improper privilege management flaw, giving local users more control over low‑level hardware than intended.
Affected Systems
The affected hardware consists of a broad range of AMD processors, including all Athlon 3000 series mobile and desktop models, Ryzen 3000 through 9000 series desktop, mobile, and high‑end workstation processors, Threadripper series, and the recent AI and Xeon‑like Z1/Z2 families that incorporate DDR5 memory support.
Risk and Exploitability
With a CVSS score of 6.9, the risk is medium to high for systems where local users have sufficient privileges to interact with the PMIC. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation at this time. An attacker needs local user access and the ability to trigger the AGESA firmware’s PMIC control; no remote network vector is recognized from the current information.
