A malicious hypervisor may manipulate Memory Mapped I/O (MMIO) routing, potentially compromising SEV-SNP integrity in some AMD processors.
Refer to Glossary for explanation of terms
Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to potentially redirect access to MMIO memory resulting in loss of guest memory integrity.
5.9 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
CWE-1220: Insufficient Granularity of Access Control
Specific CVSS scores may change subject to your implementation. We encourage you to calculate CVSS scores independently for your system.
Affected Products and Mitigation
AMD plans to release to the Original Equipment Manufacturers (OEM) the Platform Initialization (PI) firmware versions on the target dates listed below. Please your OEM for the BIOS update specific to your product(s).
*Note: Products believed to not be affected by the listed CVEs are not included.AMD EPYC™ Series Processors
AMD EPYC™ Series Processors
Platform Initialization (PI) Mitigation
TCB Values for SNP Attestation
AMD EPYC™ 7003 Series Processors
Target release planned for Dec'26
AMD EPYC™ 8004 Series Processors
Target release planned for Dec'26
AMD EPYC™ 8005 Series Processors
Target release planned for Dec'26
AMD EPYC™ 9004 Series Processors
Target release planned for Dec'26
AMD EPYC™ 9005 Series Processors
Target release planned for Dec'26
AMD EPYC™ Embedded Series Processors
Mitigation Release Date
AMD EPYC™ Embedded 7003 Series Processors
Target release planned for Feb'27
AMD EPYC™ Embedded 8004 Series Processors
Target release planned for Feb'27
AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo")
Target release planned for Feb'27
AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa")
Target release planned for Feb'27
AMD EPYC™ Embedded 9005 Series Processors
Target release planned for Feb'27
AMD thanks the following for reporting and engaging in coordinated vulnerability disclosure:
External Researchers: Chris Wech, Philipp Giersfeld, Benedict Schlüter, and Shweta Shinde ETH Zurich: CVE-2026-0462
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
