{"id":"CVE-2026-84005","kind":"vulnerability","aliases":["CVE-2026-84005"],"related":[],"title":"AMD Zen processors: optimization can expose data to a local authorized user","description":"Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally.","summary":"AMD Zen processors can remove or modify security-critical code through processor optimization, letting an authorized attacker disclose information. The attack is local, so it requires access to the machine first.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd","firmware","infrastructure","local-access","zen"],"not_affected_if":["no-untrusted-local-users","non-amd-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:24+00:00","first_seen_at":"2026-11-10T19:25:18+00:00","triaged_at":"2026-11-10T20:00:34+00:00","updated_at":"2026-11-10T20:00:34+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:00:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AMD Zen processors: optimization can expose data to a local authorized user","impact":"low","summary":"AMD Zen processors can remove or modify security-critical code through processor optimization, letting an authorized attacker disclose information. The attack is local, so it requires access to the machine first.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["amd","zen","local-access","firmware"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local authorized user reads information they should not see","analyst_note":"Find AMD's security bulletin for this CVE to confirm affected Zen generations and the fixed microcode or firmware version.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-amd-hardware","no-untrusted-local-users"],"who_is_affected":"Affects AMD Zen-based processors, so systems running on them are in scope. The sources do not describe the specific configuration or workload that is exposed, nor which firmware or microcode versions are affected. Systems where only trusted users have local access carry less practical risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":4492,"output_tokens":443,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84005':15A,18A 'access':24B,53B 'allow':71C 'amd':1A,19B,26B,69C 'attack':43B,47B,74C 'author':11A,42B,73C 'code':36B,67C 'critic':35B,66C 'cve':13A,16A 'data':7A 'disclos':44B,76C 'expos':6A 'firmwar':20B 'first':57B 'inform':45B,77C 'infrastructur':21B 'let':40B 'local':10A,23B,49B,78C 'local-access':22B 'machin':56B 'modif':62C 'modifi':32B 'optim':4A,39B,59C 'processor':3A,28B,38B,58C 'remov':30B,60C 'requir':52B 'secur':34B,65C 'security-crit':33B,64C 'user':12A 'zen':2A,25B,27B,70C","nicknames":[],"mitigations":[],"who_affected":"Affects AMD Zen-based processors, so systems running on them are in scope. The sources do not describe the specific configuration or workload that is exposed, nor which firmware or microcode versions are affected. Systems where only trusted users have local access carry less practical risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amd","firmware","infrastructure","localaccess","medium","zen"],"campaign_type":null,"search_a":"'-2026':14A,17A '-84005':15A,18A 'amd':1A 'author':11A 'cve':13A,16A 'data':7A 'expos':6A 'local':10A 'optim':4A 'processor':3A 'user':12A 'zen':2A","search_b":"'access':24B,53B 'amd':19B,26B 'attack':43B,47B 'author':42B 'code':36B 'critic':35B 'disclos':44B 'firmwar':20B 'first':57B 'inform':45B 'infrastructur':21B 'let':40B 'local':23B,49B 'local-access':22B 'machin':56B 'modifi':32B 'optim':39B 'processor':28B,38B 'remov':30B 'requir':52B 'secur':34B 'security-crit':33B 'zen':25B,27B","search_c":"'allow':71C 'amd':69C 'attack':74C 'author':73C 'code':67C 'critic':66C 'disclos':76C 'inform':77C 'local':78C 'modif':62C 'optim':59C 'processor':58C 'remov':60C 'secur':65C 'security-crit':64C 'zen':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84005","severity":null,"published_at":"2026-11-10T19:21:24+00:00","modified_at":"2026-11-10T19:21:24+00:00","first_seen_at":"2026-11-10T19:25:18+00:00","fetched_at":"2026-11-10T19:25:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}