Medium severity · published Jun 27, 2025
CVE-2024-36347
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting…
6.4
CVSS
0.1%
EPSS
No
On KEV
Description
Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AA
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 4004 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7001 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7002 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7003 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9004 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9005 Series · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 3000 · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 7002 · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 7003 · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 8004 · AMD
All versions, or not specified · source: vendor
Affected product
AA
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
AMD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36347
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36347
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
More from AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
8.8
CVE-2024-36342
Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
7.5
CVE-2024-36354
Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or…
7.5
CVE-2024-21947
Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at…
7.4
CVE-2023-20577
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution