---
id: "CVE-2026-0003"
page: "https://infrastack.ai/live/CVE-2026-0003"
kind: "vulnerability"
aliases: ["CVE-2026-0003"]
title: "AMD SEV firmware: static bootloader key lets attackers downgrade and decrypt memory"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["amd", "confidential-computing", "hypervisor", "infrastructure", "sev"]
not_affected_if: ["no-amd-sev", "non-amd-hardware"]
published_at: "2026-11-10T23:17:19+00:00"
first_seen_at: "2026-11-10T23:27:36+00:00"
updated_at: "2026-11-10T23:28:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0003", "first_seen_at": "2026-11-10T23:27:36+00:00"}]
exploit_sources: []
---

# AMD SEV firmware: static bootloader key lets attackers downgrade and decrypt memory

Link for people: https://infrastack.ai/live/CVE-2026-0003 (this .md is for agents)

The AMD ASP Bootloader uses a static key shared across parts, so an attacker can install older, vulnerable Secure Encrypted Virtualization firmware. Once the firmware is downgraded, known flaws can be used to decrypt guest memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T23:27:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-0003

## From the sources

Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_