5.4 Medium

CVE-2026-0438 A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory

Description

A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker could, with active user interaction and under high complexity and present preconditions, trigger execution of attacker-controlled code in SMM, potentially compromising the system’s confidentiality, integrity, and availability.

Affected products and versions

Product	Affected versions	Fixed in
AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics	Versions not published
AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics	Versions not published
AMD Ryzen™ 7000 Series Desktop Processors	Versions not published
AMD Ryzen™ 9000HX Series Processors	Versions not published
AMD Ryzen™ AI 300 Series Processors	Versions not published
AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors	Versions not published
AMD Ryzen™ 8000 Series Desktop Processors	Versions not published
AMD Ryzen™ 9000 Series Desktop Processors	Versions not published
AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics	Versions not published

Show the 16 other branches

Product	Affected versions	Fixed in
AMD Ryzen™ AI Max 300 Series Processors	Versions not published
AMD Ryzen™ Z1 Series Processors	Versions not published
AMD Ryzen™ Z2 Series Processors Extreme	Versions not published
AMD Ryzen™ Z2 Series Processors	Versions not published
AMD Ryzen™ Threadripper™ 7000 Processors	Versions not published
Not public	Versions not published
AMD Ryzen™ Threadripper™ 9000 Processors	Versions not published
AMD Ryzen™ Threadripper™ PRO 9000 WX-Series Processors	Versions not published
AMD Ryzen™ 7000 Series Desktop Processors (formerly codenamed "Raphael")	Versions not published
AMD Ryzen™ 8000 Series Desktop Processors (formerly codenamed "Phoenix")	Versions not published
AMD Ryzen™ 9000 Series Desktop Processors (formerly codenamed "Granite Ridge")	Versions not published
AMD Ryzen™ Embedded 9000 Series Processors	Versions not published
AMD Ryzen™ Embedded 8000 Series Processors	Versions not published
AMD Ryzen™ Embedded 7000 Series Processors	Versions not published
AMD EPYC™ 4004 Series Processors	Versions not published
AMD EPYC™ 4005 Series Processors	Versions not published

References

www.amd.com www.amd.com
www.amd.com www.amd.com

Timeline

Published May 15, 2026
Last modified May 19, 2026

The 38 CVEs of AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics →

CVE-2026-43603 A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of… 6.9 Medium CVE-2024-36343 Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to… 4.6 Medium CVE-2025-0044 An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially… 4.8 Medium CVE-2025-48516 Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with… 6.9 Medium

Track this CVE