An incorrect use of the boot service in the AMD Platform Configuration Blob SMM driver can allow a privileged attacker with local Ring 0 access to elevate privileges and potentially execute arbitrary code. The flaw is a local elevation weakness that can compromise system integrity if an attacker can subvert privileged local components.

The flaw affects a broad range of AMD processors, including AMD Athlon 3000 Series Mobile Processors with Radeon Graphics, AMD EPYC 4004/7002/7003/8004/9004/9005/9V64H Series Processors, AMD EPYC Embedded 7002/7003/8004/9004 Series Processors, AMD Instinct MI300A Series Processors, AMD Ryzen 3000/4000/5000/6000/7000/7020/7030/7035/7040/7045/8000/8040/9000/9000HX Series Desktop and Mobile Processors, AMD Ryzen AI 300/300 Max Series Processors, AMD Ryzen Embedded 5000/7000/8000/9000/R1000/R2000/V1000/V2000/V3000 Series Processors, AMD Ryzen Threadripper 7000/9000 and AMD Ryzen Threadripper PRO 3000 WX/PRO 5000 WX/PRO 7000 WX/PRO 9000 WX Series Processors, and AMD Ryzen Z1/Z2/Z2 Extreme/Z2 Go Series Processors.

The CVSS score of 7.1 denotes high severity, but exploitation requires local privileged (Ring 0) conditions and the EPSS score of < 1% (approximately 0.0002) indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly disclosed exploit at present. Nonetheless, an attacker with local privilege can use the misused boot service within SMM to obtain arbitrary code execution.