AMD Secure Processor SPDM driver: insufficient parameter sanitization risks platform integrity loss

CVSS 6.9CVE-2026-0436Firmware, BMC & network fabriccurated

Impact

The SPDM driver inside the AMD Secure Processor's trusted execution environment does not properly sanitize its parameters. Malicious input could cause loss of platform integrity, memory leakage or denial of service. SPDM is the protocol used to authenticate and attest devices, so a flaw in the ASP's SPDM path weakens the root of trust that confidential computing and device attestation depend on. The CVSS vector rates integrity impact as high on both the ASP and the systems that depend on it. Affected parts are EPYC 9005 (including Embedded) and the Instinct MI300C APU.

Who can reach it

A local attacker with low privileges on the host. The CVSS vector rates attack complexity as high. The record does not say which interface delivers the input to the SPDM driver.

What to do

See AMD-SB-3053 for the fixed ASP / platform firmware for EPYC 9005 and MI300C. The record does not give versions. Secure Processor firmware normally arrives in a platform BIOS update, which means a flash and reboot per node. Drain each node before updating.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-0436 https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3053.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.