CVE-2022-32295: Amperecomputing Ampere Altra Firmware

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor component.

Affected products

• Amperecomputing Ampere Altra Firmware: before 1.09 (fixed in 1.09)
• Amperecomputing Ampere Altra Max Firmware: before 1.09 (fixed in 1.09)

Published 2022-07-01. Last modified 2026-06-17.