CVE-2025-54518 AMD CVE debrief

Who should care

Organizations using Zen 2-based products should prioritize patching this vulnerability to prevent potential privilege escalation attacks. This includes reviewing and updating their inventory of affected systems, applying patches or mitigations provided by the vendor, and ensuring that their security controls are adequate to detect and respond to potential exploitation attempts. Security teams should also monitor for any signs of exploitation and be prepared to respond quickly in case of an incident.

Technical summary

The vulnerability CVE-2025-54518 is caused by improper isolation of shared resources within the CPU operation cache on Zen 2-based products. This could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation. The CVSS vector for this vulnerability is CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The weakness associated with this vulnerability is CWE-1189 ( Improper Isolation of Shared Resources) and CWE-1220.

Defensive priority

High priority should be given to patching this vulnerability, as it has a high CVSS score and could lead to privilege escalation. Organizations should review their inventory of Zen 2-based products, apply patches or mitigations provided by AMD, and monitor for potential exploitation attempts.

Recommended defensive actions

• Review and update inventory of Zen 2-based products
• Apply patches or mitigations provided by AMD
• Monitor for signs of exploitation and be prepared to respond quickly in case of an incident
• Ensure security controls are adequate to detect and respond to potential exploitation attempts
• Consider implementing compensating controls if patches are not immediately available

Evidence notes

The CVE-2025-54518 vulnerability was published on May 15, 2026, and last modified on June 30, 2026. The vulnerability affects Zen 2-based products and has a CVSS score of 7.3. AMD has released a security bulletin (AMD-SB-7052) addressing this issue. Additional information and patches can be found through various sources, including Openwall, Xen, and Red Hat. However, the exact scope of affected products and the completeness of the patching process are not clear from the available information.

Official resources