CVE-2025-54504 · Infrastructure
NO FIX YET
AMD SEV firmware has an access control gap that lets an attacker with administrative privileges write to a trusted region used by SEV-ES. The result is loss of integrity for protected virtual machine state.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affects hosts running AMD EPYC processors with SEV or SEV-ES enabled for virtual machines, where the attacker already has administrative control of the host. Teams that do not run confidential VMs on AMD hardware can likely skip it. The sources do not list affected firmware versions.
Not affected if no-sev-enabled, non-amd-hardware
Who cares amd, confidential-computing, hypervisor, sev, sev-es
Unknown from the sources.
No fix yet, per the sources.
Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker to write to a trusted region used by AMD Secure Encrypted Virtualization-Encrypted State (SEV-ES), potentially resulting in loss of integrity.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.