AMD Epyc Embedded 9004 vulnerabilities

9 CVEs affecting AMD Epyc Embedded 9004, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-36347, published 2025-06-27.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-31356, published 2024-08-13. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity.
• CVE-2024-21925, published 2025-02-11. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code execution.
• CVE-2023-31345, published 2025-02-12. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.
• CVE-2023-31343, published 2025-02-11. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.
• CVE-2023-31342, published 2025-02-11. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.
• CVE-2023-31352, published 2025-02-11. Medium severity, CVSS 6.0. EPSS: 0.2% chance of exploitation in the next 30 days. A bug in the SEV firmware may allow an attacker with privileges to read unencrypted memory, potentially resulting in loss of guest private data.
• CVE-2023-20582, published 2025-02-11. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults to bypass RMP checks in SEV-SNP, potentially leading to a…
• CVE-2023-20581, published 2025-02-11. Low severity, CVSS 2.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory integrity.
• CVE-2024-36347, published 2025-06-27. Medium severity, CVSS 6.4. EPSS: 0.1% chance of exploitation in the next 30 days. Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity…