Low severity · published Jul 8, 2025
CVE-2024-36348
A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially…
3.8
CVSS
0.3%
EPSS
No
On KEV
Description
A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially resulting in information leakage.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 4004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7002 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7003 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 8004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9V64H Processor · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 7002 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 7003 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 8004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 9004 Series Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 3000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
Affected product
AA
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
AMD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36348
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36348
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/08/28/2
More from AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
8.8
CVE-2024-36342
Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
8.2
CVE-2024-0179
SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code…
8.2
CVE-2022-23815
Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leading to arbitrary code execution
8.2
CVE-2021-26344
An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to modify the BIOS image, and the ability to…