{"id":"CVE-2026-0003","aliases":[],"cve":{"records":[{"id":"CVE-2026-0003","source":"AMD","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2025-10-09T19:57:20.770Z","published":"2026-11-10T22:12:39.351Z","modified":"2026-11-12T23:51:30.891Z"}],"publishers":[{"name":"AMD","role":"CNA","organizationId":"b58fc414-a1e4-4f92-9d70-1add41838648","modified":"2026-11-10T22:12:39.351Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T23:51:30.891Z"}],"references":[{"url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html","tags":[],"source":"AMD"}],"weaknesses":[{"id":"CWE-321","description":"CWE-321  Use of Hard-coded Cryptographic Key","source":"AMD"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T23:51:15.343545Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known…","titleSource":"AMD","descriptionSource":"AMD","description":"Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.","score":5.9,"severity":"medium","published":"2026-11-10T22:12:39.351Z","modified":"2026-11-12T23:51:30.891Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"AMD","name":"AMD EPYC™ 9004 Series Processors","platforms":[],"versions":[{"version":"GenoaPI_1.0.0.J","status":"unaffected"}],"defaultStatus":"affected","cpes":[],"source":"AMD","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"},{"vendor":"AMD","name":"AMD EPYC™ 7003 Series Processors","platforms":[],"versions":[{"version":"MilanPI-SP3_1.0.0.K","status":"unaffected"}],"defaultStatus":"affected","cpes":[],"source":"AMD","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"},{"vendor":"AMD","name":"AMD EPYC™ 8004 Series Processors","platforms":[],"versions":[{"version":"GenoaPI_1.0.0.J","status":"unaffected"}],"defaultStatus":"affected","cpes":[],"source":"AMD","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"},{"vendor":"AMD","name":"AMD EPYC™ Embedded 7003 Series Processors","platforms":[],"versions":[{"version":"EmbMilanPI-SP3 1.0.0.E","status":"unaffected"}],"defaultStatus":"affected","cpes":[],"source":"AMD","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"},{"vendor":"AMD","name":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","platforms":[],"versions":[{"version":"EmbeddedGenoaPI_1.0.0.E","status":"unaffected"}],"defaultStatus":"affected","cpes":[],"source":"AMD","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"},{"vendor":"AMD","name":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","platforms":[],"versions":[{"version":"EmbeddedGenoaPI_1.0.0.E","status":"unaffected"}],"defaultStatus":"affected","cpes":[],"source":"AMD","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"},{"vendor":"AMD","name":"AMD EPYC™ Embedded 8004 Series Processors","platforms":[],"versions":[{"version":"EmbeddedGenoaPI_1.0.0.E","status":"unaffected"}],"defaultStatus":"affected","cpes":[],"source":"AMD","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"}],"remediation":[],"references":["https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"],"sources":[{"name":"CVE","id":"CVE-2026-0003","modified":"2026-11-12T23:51:30.891Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"}],"assessments":[{"source":"AMD","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","score":5.9}],"sourceAffected":[],"observedAt":"2026-11-13T00:26:50.143Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:45:32.848Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T00:50:38.901Z","attemptedAt":"2026-11-13T00:50:38.901Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T00:50:39.948Z","attemptedAt":"2026-11-13T00:50:39.948Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T00:50:37.733Z","attemptedAt":"2026-11-13T00:50:37.733Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T00:50:38.346Z","attemptedAt":"2026-11-13T00:50:38.346Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-123050","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123050","modified":"Nov 10, 2026, 10:12:39 PM","score":5.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","checkedAt":"2026-11-13T00:50:37.733Z"},{"source":"FIRST EPSS","id":"CVE-2026-0003","url":"https://www.first.org/epss/","probability":0.00154,"percentile":0.04623,"date":"2026-11-12","checkedAt":"2026-11-13T00:50:38.346Z"},{"source":"NVD","id":"CVE-2026-0003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0003","modified":"2026-11-13T00:20:05.643","score":5.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-13T00:50:38.901Z"},{"source":"GitHub Advisory Database","id":"GHSA-rqjg-x7h2-mhr5","url":"https://github.com/advisories/GHSA-rqjg-x7h2-mhr5","modified":"2026-11-11T00:32:43Z","checkedAt":"2026-11-13T00:50:39.948Z"}],"aiSummary":{"text":"The ASP Bootloader in AMD EPYC processors uses a per-part static key, potentially allowing an attacker to downgrade Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities, resulting in loss of confidentiality. The affected versions are not specified, but some versions are listed as unaffected.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T08:31:11.569Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-0003"}]}}