{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0003", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2025-10-09T19:57:20.770Z", "datePublished": "2026-11-10T22:12:39.351Z", "dateUpdated": "2026-11-10T22:12:39.351Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2026-11-10T22:12:39.351Z"}, "affected": [{"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 9004 Series Processors", "versions": [{"version": "GenoaPI_1.0.0.J", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 7003 Series Processors", "versions": [{"version": "MilanPI-SP3_1.0.0.K", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 8004 Series Processors", "versions": [{"version": "GenoaPI_1.0.0.J", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 7003 Series Processors", "versions": [{"version": "EmbMilanPI-SP3 1.0.0.E", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 9004 Series Processors (formerly codenamed \"Genoa\")", "versions": [{"version": "EmbeddedGenoaPI_1.0.0.E", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")", "versions": [{"version": "EmbeddedGenoaPI_1.0.0.E", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "AMD EPYC\u2122 Embedded 8004 Series Processors", "versions": [{"version": "EmbeddedGenoaPI_1.0.0.E", "status": "unaffected"}]}], "datePublic": "2026-11-10T22:09:10.637Z", "descriptions": [{"lang": "en", "value": "Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality.<br>"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "AMD EPYC\u2122 9004 Series Processors", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "GenoaPI_1.0.0.J"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 7003 Series Processors", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "MilanPI-SP3_1.0.0.K"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 8004 Series Processors", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "GenoaPI_1.0.0.J"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 Embedded 7003 Series Processors", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "EmbMilanPI-SP3 1.0.0.E"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 Embedded 9004 Series Processors (formerly codenamed \"Genoa\")", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "EmbeddedGenoaPI_1.0.0.E"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "EmbeddedGenoaPI_1.0.0.E"}]}, {"defaultStatus": "affected", "product": "AMD EPYC\u2122 Embedded 8004 Series Processors", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "EmbeddedGenoaPI_1.0.0.E"}]}], "source": "psirt@amd.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality."}], "id": "CVE-2026-0003", "lastModified": "2026-11-10T23:17:19.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@amd.com", "type": "Secondary"}]}, "published": "2026-11-10T23:17:19.190", "references": [{"source": "psirt@amd.com", "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3038.html"}], "sourceIdentifier": "psirt@amd.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "psirt@amd.com", "type": "Secondary"}]}

{}

{"created": "2026-11-11T12:00:23.241726+00:00", "title": "Static ASP Bootloader Key Allows SEV Firmware Downgrade and Memory Decryption", "updated": "2026-11-11T12:00:23.241745+00:00", "vendors": []}