Insufficient sanitization of parameters in the AMD Secure Processor (ASP) TEE SOC Driver allows a malformed SR-IOV command (DRV_SOC_CMD_ID_LOAD_GFX_IP_FW) to trigger an out-of-bounds read. The read may expose sensitive SOC Driver memory contents or cause an exception, potentially compromising confidential driver data.

The vulnerability affects a range of AMD GPUs and graphics products, including the AMD Instinct MI210, MI250, MI300A, MI300X, MI308X, MI325X and various AMD Radeon PRO and RX series. No specific version information is provided, so all current firmware or driver revisions of the listed products are considered at risk.

The CVSS score of 4.6 indicates moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is likely an entity capable of sending a malformed SR-IOV command to the ASP TEE SOC Driver; the exact prerequisites are not specified, but it would generally require local privileges or the ability to interact with the driver’s command interface. Exploitation could lead to memory exposure or driver exception, with no clear evidence of remote code execution or privilege escalation at this time.