CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics

product · product:amd-ryzen-4000-series-mobile-processors-with-radeon-graphics

Coverage
1
first 2026-05-16 → last 2026-10-21
Latest activity
2026-05-16
AMD Zen 2 op-cache flaw lets local code escalate privilege, guest to host included; Ryzen needs OEM BIOS…
Peak priority
routine
1 routine
Targets
technology
sectors: technology, public-sector, education
Sources cited
4
4 hosts

Defender insights

What each entry about AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics tells a defender to do, newest first.

2026-05-16ROUTINEAMD Zen 2 op-cache flaw lets local code escalate privilege, guest to host included; Ryzen needs OEM BIOS updates

Exposure

Story timeline

  1. 2026-05-16AMD-SB-7052 / CVE-2025-54518: AMD Zen 2 op-cache corruption lets local code run instructions at a higher privilege, guest to host included (CVSS 7.3); OS updates on EPYC 7002, OEM BIOS updates on Ryzen
    trending-vulnerabilitiesAMD Zen 2 op-cache flaw lets local code escalate privilege, guest to host included; Ryzen needs OEM BIOS updates

Hunting pivots

CVEs
CVE-2025-54518
Releases covered
AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics
Tags
lpepatch-availablevulnerabilities
ATT&CK techniques (2 across 1 tactic)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation · Escape to Host

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-16/amd-sb-7052-cve-2025-54518-amd-zen-2-op-cache-corruption-soc · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-05-16/amd-sb-7052-cve-2025-54518-amd-zen-2-op-cache-corruption-soc · ATT&CK page ↗

Entries about AMD Ryzen 4000 Series Mobile Processors with Radeon Graphics (1)

2026-05-16 · view entry permalink →

ROUTINECVE-2025-54518updatedNATOA2

AMD-SB-7052 / CVE-2025-54518: AMD Zen 2 op-cache corruption lets local code run instructions at a higher privilege, guest to host included (CVSS 7.3); OS updates on EPYC 7002, OEM BIOS updates on Ryzen

AMD disclosed on 2026-05-12 that improper isolation of shared resources in the CPU operation cache of Zen 2-based products can cause incorrect instructions to execute at a higher privilege level; it scores CVE-2025-54518 at 7.3 on CVSS 4.0, with local access, high attack complexity and low privileges, and found it internally (AMD Product Security, 2026-05-12). Xen says code of any privilege could escalate, including userspace to kernel and guest to host, that only AMD Fam17h (Zen 2) CPUs are believed vulnerable, that all Xen versions are affected and that there is no mitigation other than its patches (Xen Project, 2026-05-12). Microsoft lists the flaw as not exploited or publicly disclosed and rates it Exploitation Unlikely, and says the latest Windows builds enable the mitigation (MSRC, CVE-2025-54518).

The fix depends on the product line: for EPYC 7002 and EPYC Embedded 7002 processors AMD's mitigation is an OS update from the OS vendor, while for Ryzen 3000, 4000, 5000, 7020 and 7030 series, Threadripper PRO 3000 WX and Ryzen Embedded V2000 AMD released Platform Initialization firmware to OEMs between October and December 2025, to be installed as an OEM BIOS update, for example ComboAM4v2 PI version 1.2.0.10 for Ryzen 3000, 4000 and 5000 desktop parts (AMD Product Security, 2026-05-12). NCSC-NL lists updates from Debian (Xen), Dell PowerEdge, Fedora, Google Cloud Platform, Lenovo and Microsoft Windows (NCSC-NL, 2026-05-15).

AMD has identified a vulnerability in the CPU operation (op/µop) cache on Zen 2‑based products that can cause incorrect instructions to be executed at a higher privilege level.

AMD recommends updating to the Platform Initialization (PI) version indicated below.

AMD Product Security 2026-05-12

Code of any privilege could escalate to a higher privilege, including userspace to kernel, and guest to host.

Xen Project

This CVE is being documented in the Security Update Guide to announce that the latest builds of Windows enable the mitigation and provide protection against the vulnerability.

Microsoft Security Response Center 2026-05-12
Correctionrun 2026-10-21T1148Z-auditactionsaffected_productsbodyclassificationcvesevent_dateevidenceheadlinesourcessourcing_notesummarytechniquestitlepriority

The mitigation does not ship as microcode in a Windows update for every affected chip: AMD lists an OS update only for EPYC 7002 and EPYC Embedded 7002 processors, and for Ryzen 3000 to 7030 series, Threadripper PRO 3000 WX and Ryzen Embedded V2000 it recommends the Platform Initialization versions in its table, delivered as OEM BIOS updates (AMD Product Security, 2026-05-12). Microsoft says the latest Windows builds enable the mitigation, not that they carry it for all processors (MSRC, CVE-2025-54518), so a Windows build check cannot confirm a Ryzen host is protected, and a processor-ID query reports the CPU model rather than whether the mitigation is in place.

NCSC-NL lists Fedora and Lenovo among the vendors with updates (NCSC-NL, 2026-05-15).

vulnerability16 May 05:00Zmulti-sourceOpen finding →
Sources: AMD Product Security · NCSC-NL · Xen Project (XSA-490) · Microsoft Security Response Center

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • advisories.ncsc.nl1 (25%)
  • amd.com1 (25%)
  • msrc.microsoft.com1 (25%)
  • xenbits.xen.org1 (25%)
All cited sources (4)