High severity · published Nov 23, 2025
CVE-2025-48507
The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto…
8.6
CVSS
0.2%
EPSS
No
On KEV
Description
The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KS
Kria™ SOM · AMD
Version TBD · source: vendor
ZU
Zynq™ UltraScale+™ MPSoCs · AMD
Version TBD · source: vendor
ZU
Zynq™ UltraScale+™ RFSoCs · AMD
Version TBD · source: vendor