Medium severity · published May 15, 2026
CVE-2025-0040
Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the…
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the contents of cross-chip debug (XCD) registers potentially resulting in loss of data integrity or confidentiality.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 8000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ Embedded 8000 Series Processors · AMD
All versions, or not specified · source: vendor
Affected product
AR
AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
AMD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0040
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4017.html
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6027.html
More from AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
8.8
CVE-2024-36324
Improper input validation in AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary code execution
8.7
CVE-2025-52533
Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity
8.6
CVE-2024-21962
Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation and arbitrary code…
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
8.3
CVE-2023-31364
Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to flood a host with writes, potentially…