Vulnerability in AMD Epyc™ 4004 Series Processors
CVE-2026-0438
A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker could, with active user interaction and under high complexity and present preconditions, trigger execution of attacker-controlled code in SMM, potentially compromising the system’s confidentiality, integrity, and availability.
Published · last modified .
EPSS exploit prediction
EPSS: 0.001 (2.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 2.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- AMD Epyc™ 4004 Series Processors — versions ComboAM5PI 1.0.0.d / ComboAM5PI 1.1.0.3f / ComboAM5PI_1.2.0.3i
- AMD Epyc™ 4005 Series Processors — versions ComboAM5PI_1.2.0.3i
- AMD Ryzen™ 7000 Series Desktop Processors — versions ComboAM5PI 1.0.0.d, ComboAM5PI 1.1.0.3f, ComboAM5PI_1.2.0.3i
- AMD Ryzen™ 7000 Series Desktop Processors (Formerly Codenamed "Raphael") — versions ComboAM5PI_1.3.0.0
- AMD Ryzen™ 7040 Series Mobile Processors With Radeon™ Graphics — versions PhoenixPI-FP8-FP7_1.2.0.0f
- AMD Ryzen™ 7045 Series Mobile Processors With Radeon™ Graphics — versions DragonRangeFL1PI 1.0.0.3k
- AMD Ryzen™ 8000 Series Desktop Processors — versions ComboAM5PI 1.1.0.3f, ComboAM5PI_1.2.0.3i
- AMD Ryzen™ 8000 Series Desktop Processors (Formerly Codenamed "Phoenix") — versions ComboAM5PI_1.3.0.0
- AMD Ryzen™ 8040 Series Mobile Processors With Radeon™ Graphics — versions PhoenixPI-FP8-FP7_1.2.0.0f
- AMD Ryzen™ 9000hx Series Processors — versions FireRangeFL1PI 1.0.0.0d