PatchSiren cyber security CVE debrief
CVE-2024-36343 AMD CVE debrief
CVE-2024-36343 is a medium-severity vulnerability (CVSS 4.6) affecting AMD products, published on 2026-05-19 and last modified on 2026-05-20. The vulnerability stems from improper input validation in the System Management Mode (SMM) communications buffer, which could allow a privileged attacker with local access and high privileges to perform out-of-bounds read or write operations to a limited section of the Top of Memory Segment (TSEG) memory region. This could result in loss of confidentiality or integrity. The vulnerability is classified under CWE-124 (Buffer Underwrite). The attack requires local access with high privileges, has low attack complexity, and does not require user interaction. The vendor has been identified as AMD based on reference domain evidence, though this attribution carries low confidence and requires review. Two AMD security bulletins (AMD-SB-3030 and AMD-SB-4017) are referenced as authoritative sources. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Vendor
- AMD
- Product
- AMD EPYC™ 4004
- CVSS
- MEDIUM 4.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-19
- Original CVE updated
- 2026-05-20
- Advisory published
- 2026-05-19
- Advisory updated
- 2026-05-20
Who should care
Organizations running AMD-based systems, particularly those with stringent firmware security requirements or compliance obligations around hardware root of trust. System administrators responsible for BIOS/UEFI firmware lifecycle management and security teams monitoring for firmware-level vulnerabilities should prioritize tracking vendor updates.
Technical summary
The vulnerability exists in the System Management Mode (SMM) communications buffer implementation. SMM is a highly privileged CPU operating mode used by firmware for system management functions. Improper input validation allows a privileged attacker to trigger out-of-bounds memory operations within a constrained portion of the Top of Memory Segment (TSEG), a protected memory region reserved for SMM code and data. Successful exploitation requires local access with administrative or equivalent high privileges. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N) reflects local attack vector, low attack complexity, high privilege requirements, and low impacts to confidentiality and integrity with no availability impact. The vulnerability is not known to be exploited in the wild.
Defensive priority
medium
Recommended defensive actions
- Review AMD security bulletins AMD-SB-3030 and AMD-SB-4017 for affected product lists and specific firmware versions
- Apply BIOS/UEFI firmware updates from AMD or system OEMs as they become available
- Restrict physical and administrative access to systems to reduce attack surface for local privilege exploitation
- Monitor for firmware update availability through system vendor channels
- Assess systems running AMD processors for exposure based on vendor guidance
Evidence notes
Vendor attribution based on reference domain candidate 'Amd' with low confidence; requires review. CVSS 4.0 vector indicates local attack vector, high privileges required, with low impact to confidentiality and integrity.
Official resources
2026-05-19