Medium severity · published Feb 10, 2026
CVE-2024-36311
A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform an out of bounds read…
4.6
CVSS
0.1%
EPSS
No
On KEV
Description
A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform an out of bounds read or write, potentially resulting in loss of confidentiality, integrity, or availability.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
AMD Ryzen™ 7000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 8000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 9000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 9000HX Series Mobile Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ Embedded 7000 Series Processors · AMD
All versions, or not specified · source: vendor
Affected product
AR
AMD Ryzen™ 7000 Series Desktop Processors
AMD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36311
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4013.html
More from AMD Ryzen™ 7000 Series Desktop Processors
8.8
CVE-2024-36342
Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution
8.7
CVE-2025-52533
Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity
8.6
CVE-2024-21962
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation and arbitrary code…
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
8.4
CVE-2024-36352
Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary writes or denial of service