A missing lock bit protection for NBIO registers allows a local administrator with privileged access to manipulate those registers. This permits the attacker to obtain System Management Network (SMN) access, which can be used to execute arbitrary code inside the AMD Secure Processor (ASP). The resulting compromise would lead to loss of confidentiality and integrity for SEV‑SNP guests. The vulnerability is classified as CWE‑1233, indicating a failure to enforce proper lock bit constraints on critical registers.

AMD’s EPYC 8004, 9004, 9005 processor families—including the Embedded 8004, Embedded 9004 (formerly Genoa), Embedded 9004 (formerly Bergamo) and Embedded 9005—are impacted by this flaw.

The CVSS score of 8.5 reflects a high severity risk. EPSS data is currently unavailable, so the likelihood of exploitation remains indeterminate, though the vulnerability requires local admin privilege to exploit. The flaw is not listed in the CISA KEV catalog, indicating no confirmed incident reports yet. An attacker with local admin rights on an affected system could directly gain SMN access and achieve arbitrary code execution within the secure processor, making the risk significant for environments that rely on SEV‑SNP protection.