A missing lock verification in the AMD Secure Processor firmware can allow a locally authenticated attacker with administrative privileges to change MMIO routing on selected Zen 5 products. This flaw, classified as CWE‑414, compromises the ability of a guest system to maintain isolation and integrity. The attacker could re‑route memory‑mapped I/O to unauthorized devices, potentially enabling privilege escalation within the virtualized environment.

AMD EPYC 7003 Series Processors, AMD EPYC 8004 Series Processors, AMD EPYC 9004 Series Processors, AMD EPYC 9005 Series Processors, AMD EPYC Embedded 7003 Series Processors, AMD EPYC Embedded 8004 Series Processors, AMD EPYC Embedded 9004 Series Processors, AMD EPYC Embedded 9005 Series Processors.

The vulnerability carries a CVSS score of 5.9, indicating moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation at this time. Attacks would require local administrative access to the host, making it less likely to be a widespread threat but still significant for environments where privileged users have unchecked firmware control.