{"id":"CVE-2026-0470","kind":"vulnerability","aliases":["CVE-2026-0470"],"related":[],"title":"AMD Embedded SPI Flash driver: null pointer crash lets local user halt device","description":"Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability.","summary":"A null pointer dereference in AMD's Embedded SPI Flash driver lets a local user crash the affected system. The sources describe a loss of availability, not code execution or data access.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd","embedded","firmware","infrastructure"],"not_affected_if":["no-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T14:17:27+00:00","first_seen_at":"2026-11-11T14:27:30+00:00","triaged_at":"2026-11-11T14:29:20+00:00","updated_at":"2026-11-11T14:29:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-11T14:29:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AMD Embedded SPI Flash driver: null pointer crash lets local user halt device","impact":"low","summary":"A null pointer dereference in AMD's Embedded SPI Flash driver lets a local user crash the affected system. The sources describe a loss of availability, not code execution or data access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["amd","embedded","firmware"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Local user crashes the system, causing loss of availability.","analyst_note":"Find AMD's security bulletin for CVE-2026-0470 to confirm affected products, versions and the fixed driver release.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-users"],"who_is_affected":"Systems running AMD embedded platforms with the affected SPI Flash driver. The sources do not list affected versions or which products ship this driver, so unknown. Only local users are described as able to trigger it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":4500,"output_tokens":418,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-0470':16A,19A '-2026':15A,18A 'access':55B 'affect':41B 'allow':66C 'amd':1A,20B,29B,60C 'avail':49B,76C 'caus':72C 'code':51B 'could':65C 'crash':8A,39B 'cve':14A,17A 'data':54B 'derefer':27B,58C 'describ':45B 'devic':13A 'driver':5A,34B,64C 'embed':2A,21B,31B,61C 'execut':52B 'firmwar':22B 'flash':4A,33B,63C 'halt':12A 'infrastructur':23B 'let':9A,35B 'local':10A,37B,68C 'loss':47B,74C 'null':6A,25B,56C 'pointer':7A,26B,57C 'potenti':71C 'sourc':44B 'spi':3A,32B,62C 'system':42B 'user':11A,38B,69C","nicknames":[],"mitigations":[],"who_affected":"Systems running AMD embedded platforms with the affected SPI Flash driver. The sources do not list affected versions or which products ship this driver, so unknown. Only local users are described as able to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amd","embedded","firmware","infrastructure","medium"],"campaign_type":null,"search_a":"'-0470':16A,19A '-2026':15A,18A 'amd':1A 'crash':8A 'cve':14A,17A 'devic':13A 'driver':5A 'embed':2A 'flash':4A 'halt':12A 'let':9A 'local':10A 'null':6A 'pointer':7A 'spi':3A 'user':11A","search_b":"'access':55B 'affect':41B 'amd':20B,29B 'avail':49B 'code':51B 'crash':39B 'data':54B 'derefer':27B 'describ':45B 'driver':34B 'embed':21B,31B 'execut':52B 'firmwar':22B 'flash':33B 'infrastructur':23B 'let':35B 'local':37B 'loss':47B 'null':25B 'pointer':26B 'sourc':44B 'spi':32B 'system':42B 'user':38B","search_c":"'allow':66C 'amd':60C 'avail':76C 'caus':72C 'could':65C 'derefer':58C 'driver':64C 'embed':61C 'flash':63C 'local':68C 'loss':74C 'null':56C 'pointer':57C 'potenti':71C 'spi':62C 'user':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@amd.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0470","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0470","severity":null,"published_at":"2026-11-11T14:17:27+00:00","modified_at":"2026-11-11T14:17:27+00:00","first_seen_at":"2026-11-11T14:27:30+00:00","fetched_at":"2026-11-11T14:27:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}