High severity · published May 15, 2026
CVE-2025-54518
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege…
7.0
CVSS
0.3%
EPSS
No
On KEV
Description
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
AMD EPYC™ 7002 Series Processors · AMD
All versions, or not specified · source: vendor
AE
AMD EPYC™ Embedded 7002 Series Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen Embedded V2000A Series Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 3000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 4000 Series Desktop Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ Embedded V2000 Series Processors · AMD
All versions, or not specified · source: vendor
AR
AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors · AMD
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54518
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54518
www.amd.com
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7052.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/05/12/15
xenbits.xen.org
http://xenbits.xen.org/xsa/advisory-490.html
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:50978
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:50979
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:53329
More from AMD EPYC™ 7002 Series Processors
8.7
CVE-2025-52533
Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity
8.5
CVE-2026-0432
Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code…
8.3
CVE-2023-31364
Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to flood a host with writes, potentially…
8.2
CVE-2021-26344
An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to modify the BIOS image, and the ability to…
7.9
CVE-2023-20599
Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) registers from x86 resulting in potential…