The vulnerability arises because the AMD Secure Processor (ASP) PCI driver performs improper input validation, allowing a local actor to trigger a Use‑After‑Free (UAF) condition. This flaw falls under CWE‑416. If successfully exploited, an attacker could corrupt data or cause a denial‑of‑service by crashing the platform, threatening confidentiality, integrity, and availability of the affected system.

The flaw affects a broad spectrum of AMD hardware, including the Athlon, EPYC, Ryzen, Threadripper, Ryzen Embedded, and Ryzen AI processor families—spanning desktop, mobile, embedded, and server lineups as listed in the vendor product list.

The CVSS score of 6.9 indicates a moderate to high severity. No EPSS score is available and the vulnerability is not in the CISA KEV catalog. The attack vector is inferred to be local, requiring either local user privileges or physical access to the device to supply the malformed input that triggers the UAF. The absence of a known exploit evidence suggests a limited but non‑negligible risk pending vendor mitigation.