High severity · published Sep 6, 2025
CVE-2025-0032
Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially resulting in loss of…
7.2
CVSS
0.2%
EPSS
No
On KEV
Description
Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially resulting in loss of integrity of x86 instruction execution.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
AMD EPYC™ 9005 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 9000 Series Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 9000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 9000HX Series Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ AI 300 Series Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ Al Max+ · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ Threadripper™ 9000 series · AMD
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0032
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0032
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
More from AMD EPYC™ 9005 Series Processors
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
8.5
CVE-2025-61972
Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SMN) access, potentially resulting in…
8.3
CVE-2023-31364
Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to flood a host with writes, potentially…
7.5
CVE-2025-54502
Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve privilege escalation…
7.2
CVE-2025-62626
Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially resulting in the…