A System Management Mode (SMM) handler can make a callout to code that resides in non‑SMM, untrusted memory. This flaw, classified as a CWE‑1072 issue, allows a highly privileged attacker to execute arbitrary, attacker‑controlled code within SMM. The type of impact is compromised confidentiality, integrity, and availability of the entire system, as code running in SMM has access to all system resources and can override operating system controls.

AMD products including the EPYC 4004/4005 Series processors, all Ryzen 7000‑to‑9000 Series desktop and mobile processors, the Ryzen AI and Embedded series, the Ryzen Threadripper 7000/9000‑PRO series, the Ryzen Z1 and Z2 series, and related chipset firmware. In all these cases the flaw resides in the processor firmware and affects systems running affected chips.

The CVSS score of 5.4 indicates a moderate severity. Exploitation requires a highly privileged attacker, active user interaction, and several preconditions, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is from a privileged process that can invoke SMM, for example through driver code or firmware utilities that interact with SMM. Given the complexity and necessity of user interaction, the risk in the current environment is moderate but not negligible. Caution is advised for environments where SMM is enabled and where untrusted code could be loaded into non‑SMM memory.