Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resu…

Published 14 mo ago 2025-09-06 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.2

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.2%

percentile 5%

Public exploits

none known

Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 13 mo ago 2025-09-08

Exploit prediction (EPSS)

0.16% probability of exploitation in the next 30 days, higher than 5% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	3.2	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N`
CNA	3.1	3.2	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N`

Affected products

AMD AMD EPYC™ 9004 Series Processors
AMD EPYC™ Embedded 9004 Series Processors
AMD AMD EPYC™ Embedded 9004 Series Processors

Classification

Weakness

CWE-665 Improper Initialization

References

amd.com /en/resources/product-security/bulletin/AMD-SB-5007.html
amd.com /en/resources/product-security/bulletin/AMD-SB-3014.html
lists.debian.org /debian-lts-announce/2025/10/msg00008.html

Sources

CVE List: CVE-2024-36331
NVD: CVE-2024-36331

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary