Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| AMD | AMD EPYC™ 9004 Series Processors | affected |
|
||||||
| AMD | AMD EPYC™ 7003 Series Processors | affected |
|
||||||
| AMD | AMD EPYC™ 8004 Series Processors | affected |
|
||||||
| AMD | AMD EPYC™ Embedded 7003 Series Processors | affected |
|
||||||
| AMD | AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa") | affected |
|
||||||
| AMD | AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo") | affected |
|
||||||
| AMD | AMD EPYC™ Embedded 8004 Series Processors | affected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 10 Nov 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality. | |
| Weaknesses | CWE-321 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: AMD
Published:
Updated: 2026-11-10T22:12:39.351Z
Reserved: 2025-10-09T19:57:20.770Z
Link: CVE-2026-0003
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses