s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2025-0044

📛 CVE Title

CVE-2025-0044

⬇ Download JSON ⚠ View as Threat

Description

An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial loss of confidentiality and availability.

Overview

State
PUBLISHED
Assigner (CNA)
AMD
CVSS severity
MEDIUM
CVSS score
CVSS 4.8 / 10 4.8 4.8 / 10
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Effective score
4.8 / 10 MEDIUM source: CNA overview
CWE(s)
CWE-125
Reserved
2024-11-21
Published
2026-05-15 02:49 UTC
Last updated
2026-05-15 11:26 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/0xxx/CVE-2025-0044.json
Linked Threat
CVE-2025-0044 — CVE-2025-0044

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-05-15 03:16:21 UTC
NVD last modified
2026-05-15 14:10:17 UTC
EPSS score
0.0002 (probability of exploitation in next 30 days)
EPSS percentile
3.87% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD / KEV / EPSS data refreshed 2026-05-25 06:03 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2025-209880
Assigner
AMD
Published
May 15, 2026, 2:49:13 AM
Updated
May 15, 2026, 11:26:29 AM
EUVD base score (CVSS 4.0)
4.8 / 10
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
EUVD-reported EPSS
0.0200
Vendors
AMD
Products
AMD Ryzen™ Al Max+ (patch: AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20))
AMD Radeon™ RX 7000 Series Graphics Products (patch: AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01))
AMD Ryzen™ AI 300 Series Processors (patch: AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20))
AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (patch: AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20))
AMD Radeon™ PRO W7000 Series Graphics Products (patch: AMD Software: PRO Edition 24.Q2 (24.10.20))
AMD Ryzen™ Embedded 8000 Series Processors (patch: Graphics driver: version 25.6.1, branch: 25.10.13.01. - Chipset version: 7.06.02.123)
AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (patch: AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20))
AMD Ryzen™ 8000 Series Desktop Processors (patch: AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20))
Aliases
GHSA-vjjp-rpjm-8fq9

ENISA description: An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial loss of confidentiality and availability.

EUVD references (1)

Affected products (8)
VendorProductVersionsPlatforms
AMD AMD Ryzen™ Al Max+ AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20) (unaffected) —
AMD AMD Ryzen™ AI 300 Series Processors AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20) (unaffected) —
AMD AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20) (unaffected) —
AMD AMD Ryzen™ 8000 Series Desktop Processors AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20) (unaffected) —
AMD AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20) (unaffected) —
AMD AMD Ryzen™ Embedded 8000 Series Processors Graphics driver: version 25.6.1, branch: 25.10.13.01. - Chipset version: 7.06.02.123 (unaffected) —
AMD AMD Radeon™ RX 7000 Series Graphics Products AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01) (unaffected) —
AMD AMD Radeon™ PRO W7000 Series Graphics Products AMD Software: PRO Edition 24.Q2 (24.10.20) (unaffected) —

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

Web references (4)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (11)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

  • CVE-2025-42944: Maximum-Severity OS Command Execution Vulnerability in ...
    web:arcticwolf.com

    SAP released its September 2025 Security Patch Day update with patches for 21 vulnerabilities. The most severe of these, CVE - 2025 -42944, is a maximum-severity deserialization vulnerability of untrusted Java objects in SAP NetWeaver that resides in the RMI-RP4 module.

    2026-05-23 21:16 UTC
  • Microsoft December 2025 Patch Tuesday - 56 Vulnerabilities Fixed ...
    web:cybersecuritynews.com

    Microsoft released its final Patch Tuesday updates of 2025 on December 9, addressing 56 security vulnerabilities across Windows, Office, Exchange Server, and other components.

    2026-05-23 21:16 UTC
  • Redis Releases Update to Fix CVE-2025-49844 Critical RCE Vulnerability
    web:dailysecurityreview.com

    Redis Releases Update to Fix CVE - 2025 -49844 Critical RCE Vulnerability A critical use-after-free vulnerability in Redis ( CVE - 2025 -49844) enables remote code execution via Lua scripting. Affecting all versions up to 8.2.1, the flaw is already being exploited in the wild, prompting urgent patching and mitigation calls from major security vendors.

    2026-05-23 21:16 UTC
  • Mitigating CVE-2025-22944 Remote Code Execution Vulnerability in ...
    web:learn.microsoft.com

    We manage Microsoft 365 Apps for Enterprise (Version 2409, Build 16829.20234) across 250 Windows 10/11 endpoints in an enterprise environment with Defender for Endpoint and Configuration Manager. Following the disclosure of CVE - 2025 -22944, a critical remote code execution vulnerability (CVSS 8.8) in Microsoft Office, we are urgently addressing risks from malicious file exploitation, which ...

    2026-05-23 21:16 UTC
  • Nvd - Cve-2025-42944
    web:nvd.nist.gov

    An official website of the United States government Here's how you know

    2026-05-23 21:16 UTC
  • Security Advisory: CVE-2025-49844 - Redis
    web:redis.io

    Learn about CVE - 2025 -49844 and how to secure your Redis instance. Follow best practices to protect against remote code execution. Get started now.

    2026-05-23 21:16 UTC
  • February's Patch Tuesday release fixes 59 flaws ... - Computerworld
    web:www.computerworld.com

    Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

    2026-05-23 21:16 UTC
  • Redis patches critical "RediShell" RCE vulnerability, update ASAP! (CVE ...
    web:www.helpnetsecurity.com

    Redis has released patches for a critical vulnerability ( CVE - 2025 -49844) that may allow attackers full access to the underlying host system.

    2026-05-23 21:16 UTC
  • Oracle Critical Patch Update Advisory - October 2025
    web:www.oracle.com

    This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.

    2026-05-23 21:16 UTC
  • Microsoft fixes 167 security flaws in April, second biggest Patch ...
    web:www.pcworld.com

    This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

    2026-05-23 21:16 UTC
  • Windows Kerberos RC4 deprecation: what will break in Active ... - 4sysops
    web:4sysops.com

    Starting in April 2026, Windows updates will change the default Kerberos ticket issuance behavior to AES-SHA1 for accounts without explicit encryption settings, while RC4 can still be used where explicitly enabled. This change, driven by CVE -2026-20833, affects every Windows Server environment where service accounts or devices still rely on RC4. Any service account, NAS device, or legacy ...

    2026-05-26 02:56 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2025-0044.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0044",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T11:26:12.501732Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T11:26:29.464Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Al Max+",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20)"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 AI 300 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20)"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 7040 Series Mobile Processors with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20)"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 8000 Series Desktop Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20)"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 8040 Series Mobile Processors with Radeon\u2122 Graphics",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01), AMD Software: PRO Edition 24.Q2 (24.10.20)"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Ryzen\u2122 Embedded 8000 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "Graphics driver: version 25.6.1, branch: 25.10.13.01. - Chipset version: 7.06.02.123"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Radeon\u2122 RX 7000 Series Graphics Products",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "AMD Software: Adrenalin Edition 24.7.1 (24.10.29.01)"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD Radeon\u2122 PRO W7000 Series Graphics Products",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "AMD Software: PRO Edition 24.Q2 (24.10.20)"
            }
          ]
        }
      ],
      "datePublic": "2026-05-15T02:41:58.754Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial loss of confidentiality and availability.<br>"
            }
          ],
          "value": "An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial loss of confidentiality and availability."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125  Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-15T02:49:13.278Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6027.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "AMD PSIRT Automation 1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2025-0044",
    "datePublished": "2026-05-15T02:49:13.278Z",
    "dateReserved": "2024-11-21T16:18:12.240Z",
    "dateUpdated": "2026-05-15T11:26:29.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}