High severity · published Feb 10, 2026
CVE-2025-29950
Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
AMD EPYC™ 7001 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7002 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 7003 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9004 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9005 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ 9V64H Processor · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 3000 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 7002 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 7003 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 8004 Series Processors · AMD
All versions, or not specified · source: vendor
Affected product
AE
AMD EPYC™ 7001 Series Processors
AMD
More from AMD EPYC™ 7001 Series Processors
8.7
CVE-2025-52533
Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
8.3
CVE-2023-31364
Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to flood a host with writes, potentially…
8.2
CVE-2021-26344
An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to modify the BIOS image, and the ability to…
7.5
CVE-2024-36354
Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or…