CVE-2024-36347

State: Published
Severity: 6.4 Medium
Published: Jun 27, 2025
Updated: Feb 26, 2026
Reserved: May 23, 2024

Description

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	AMD

Weaknesses

CWE-347 Improper Verification of Cryptographic Signature

Affected Products

Product	Versions
AMD EPYC™ 7001 SeriesAMD	NaplesPI 1.0.0.PNot affected
AMD EPYC™ 7002 SeriesAMD	RomePI 1.0.0.LNot affected
AMD EPYC™ 7003 SeriesAMD	MilanPI 1.0.0.FNot affected
AMD EPYC™ 9004 SeriesAMD	Genoa 1.0.0.ENot affected
AMD EPYC™ 4004 SeriesAMD	ComboAM5PI1.0.0.aNot affected ComboAM5PI1.1.0.3cNot affected ComboAM5PI1.2.0.3Not affected
AMD EPYC™ 9005 SeriesAMD	TurinPI 1.0.0.4Not affected
AMD Instinct™ MI300AAMD	MI300PI_SR5 1.0.0.8Not affected
AMD Ryzen™ 5000 Series Desktop ProcessorsAMD	ComboAM4v2PI 1.2.0.ENot affected
AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ GraphicsAMD	ComboAM4v2PI 1.2.0.ENot affected
AMD Ryzen™ 3000 Series Desktop ProcessorsAMD	ComboAM4PI 1.0.0.DNot affected ComboAM4v2PI 1.2.0.ENot affected
AMD Athlon™ 3000 Series Desktop Processors with Radeon™ GraphicsAMD	ComboAM4PI 1.0.0.DNot affected ComboAM4v2PI 1.2.0.ENot affected
AMD Ryzen™ 7000 Series Desktop ProcessorsAMD	ComboAM5PI 1.0.0.aNot affected ComboAM5PI 1.1.0.3cNot affected ComboAM5PI 1.2.0.3Not affected
AMD Ryzen™ 4000 Series Desktop Processor with Radeon™ GraphicsAMD	ComboAM4v2PI 1.2.0.ENot affected
AMD Ryzen™ 8000 Series Processor with Radeon™ GraphicsAMD	ComboAM5PI 1.1.0.3cNot affected ComboAM5PI 1.2.0.3Not affected
AMD Ryzen™ 9000 Series Desktop ProcessorsAMD	ComboAM5PI 1.2.0.3cNot affected
AMD Ryzen™ Threadripper™ 3000 Series ProcessorsAMD	CastlePeakPI-SP3r3 1.0.0.ENot affected
AMD Ryzen™ Threadripper™ PRO 7000 WX-Series ProcessorsAMD	StormPeakPI-SP6 1.0.0.1kNot affected StormPeakPI-SP6 1.1.0.0iNot affected
AMD Ryzen™ Threadripper™ PRO 3000WX Series ProcessorsAMD	ChagallWSPI-sWRX8 1.0.0.BNot affected CastlePeakWSPI-sWRX8 1.0.0.gNot affected
AMD Ryzen™ Threadripper™ PRO 5000WX- Series Desktop ProcessorsAMD	ChagallWSPI-sWRX8 1.0.0.BNot affected
AMD Athlon™ 3000 Series Mobile Processors with Radeon™ GraphicsAMD	PicassoPI-FP5 1.0.1.2bNot affected
AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ GraphicsAMD	PicassoPI-FP5 1.0.1.2bNot affected
AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ GraphicsAMD	RenoirPI-FP6 1.0.0.EbNot affected
AMD Ryzen™ 5000 Series Processors with Radeon™ GraphicsAMD	CezannePI-FP6 1.0.1.1bNot affected
AMD Ryzen™ 7020 Series Processors with Radeon™ GraphicsAMD	MendocinoPI-FT6 1.0.0.7bNot affected
AMD Ryzen™ 6000 Series Processor with Radeon™ GraphicsAMD	RembrandtPI-FP7 1.0.0.BbNot affected
AMD Ryzen™ 7035 Series Processor with Radeon™ GraphicsAMD	RembrandtPI-FP7 1.0.0.BbNot affected
AMD Ryzen™ 7000 Series Processors with Radeon™ GraphicsAMD	CezannePI-FP6 1.0.1.1bNot affected
AMD Ryzen™ 7040 Series Processors with Radeon™ GraphicsAMD	PhoenixPI-FP8-FP7 1.2.0.0Not affected
AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ GraphicsAMD	PhoenixPI-FP8-FP7 1.2.0.0Not affected
AMD Ryzen™ 7045 Series Mobile ProcessorsAMD	DragonRangeFL1 1.0.0.3gNot affected
AMD Ryzen™ AI 300 SeriesAMD	StrixKrakenPI-FP8_1.1.0.0bNot affected
AMD Ryzen™ AI Max +AMD	StrixHaloPI-FP11_1.0.0.1Not affected
AMD Ryzen™ 9000HX Series Mobile ProcessorsAMD	FireRangeFL1PI 1.0.0.0aNot affected
AMD EPYC™ Embedded 3000AMD	SnowyOwl PI 1.1.0.ENot affected
AMD EPYC™ Embedded 7002AMD	EmbRomePI-SP3 1.0.0.DNot affected
AMD EPYC™ Embedded 7003AMD	EmbMilan PI-SP3 1.0.0.ANot affected
AMD EPYC™ Embedded 8004AMD	EmbGenoaPI-SP5 1.0.0.9Not affected
AMD EPYC™ Embedded 9004AMD	EmbGenoaPI-SP5 1.0.0.9Not affected
AMD EPYC™ Embedded 97X4AMD	EmbGenoaPI-SP5 1.0.0.9Not affected
AMD Ryzen™ Embedded R1000AMD	EmbeddedPI-FP5 1.2.0.FNot affected
AMD Ryzen™ Embedded R2000AMD	EmbeddedR2KPI 1.0.0.5Not affected
AMD Ryzen™ Embedded 5000AMD	EmbAM4PI 1.0.0.7Not affected
AMD Ryzen™ Embedded 7000AMD	EmbeddedAM5PI 1.0.0.3Not affected
AMD Ryzen™ Embedded V1000AMD	EmbeddedPI-FP5 1.2.0.FNot affected
AMD Ryzen™Embedded V2000AMD	EmbeddedPI-FP6 1.0.0.BNot affected
AMD Ryzen™Embedded V3000AMD	EmbeddedPI-FP7R2 1.0.0.CNot affected

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.