{"id":"CVE-2023-20577","title":"A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.","summary":"A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-121"],"vendor":"AMD","product":"2nd Gen AMD EPYC™ Processors","affected":["2nd_gen_amd_epyc_processors (all versions)","3rd_gen_amd_epyc_processors (all versions)","4th_gen_amd_epyc_processors (all versions)","instinct_mi300a (all versions)","ryzen_3000_series_desktop_processors (all versions)","ryzen_5000_series_desktop_processors (all versions)","ryzen_5000_series_desktop_processors_with_radeon_graphics (all versions)","ryzen_7000_series_processors (all versions)","athlon_3000_series_desktop_processors_with_radeon_graphics (all versions)","ryzen_4000_series_desktop_processors_with_radeon_graphics (all versions)","ryzen_threadripper_3000_series_processors (all versions)","ryzen_threadripper_pro_3000wx_series_processors (all versions)","ryzen_threadripper_pro_5000wx_processors (all versions)","athlon_3000_series_mobile_processors_with_radeon_graphics (all versions)","athlon_3000_series_mobile_processors_with_radeon_graphics (all versions)","ryzen_3000_series_mobile_processor_with_radeon_graphics (all versions)","ryzen_4000_series_mobile_processors_with_radeon_graphics (all versions)","ryzen_5000_series_mobile_processors_with_radeon_graphics (all versions)","ryzen_5000_series_mobile_processors_with_radeon_graphics (all versions)","ryzen_7020_series_processors_with_radeon_graphics (all versions)","ryzen_6000_series_processors_with_radeon_graphics (all versions)","ryzen_7035_series_processors_with_radeon_graphics (all versions)","ryzen_5000_series_processors_with_radeon_graphics (all versions)","ryzen_3000_series_processors_with_radeon_graphics (all versions)","ryzen_7040_series_processors_with_radeon_graphics (all versions)","ryzen_7045_series_mobile_processors (all versions)","epyc_embedded_3000 (all versions)","epyc_embedded_7002 (all versions)","epyc_embedded_7003 (all versions)","epyc_embedded_9003 (all versions)","ryzen_embedded_r1000 (all versions)","ryzen_embedded_r2000 (all versions)","ryzen_embedded_5000 (all versions)","ryzen_embedded_v1000 (all versions)","ryzen_embedded_v2000 (all versions)","ryzen_embedded_v3000 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-03T03:56:43.507455Z"},"published":"2026-09-02","updated":"2026-11-03","sourceUpdated":"2026-11-03T15:02:34.068Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-20577","references":[{"url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7009.html"}],"tags":["cve.org"],"epss":0.00152,"epssPercentile":0.0443,"ingestedAt":"2026-11-05T19:30:42.973Z","slug":"CVE-2023-20577","body":"## Overview\n\nA heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.\n\n## Affected\n\n- `2nd_gen_amd_epyc_processors (all versions)`\n- `3rd_gen_amd_epyc_processors (all versions)`\n- `4th_gen_amd_epyc_processors (all versions)`\n- `instinct_mi300a (all versions)`\n- `ryzen_3000_series_desktop_processors (all versions)`\n- `ryzen_5000_series_desktop_processors (all versions)`\n- `ryzen_5000_series_desktop_processors_with_radeon_graphics (all versions)`\n- `ryzen_7000_series_processors (all versions)`\n- `athlon_3000_series_desktop_processors_with_radeon_graphics (all versions)`\n- `ryzen_4000_series_desktop_processors_with_radeon_graphics (all versions)`\n- `ryzen_threadripper_3000_series_processors (all versions)`\n- `ryzen_threadripper_pro_3000wx_series_processors (all versions)`\n- `ryzen_threadripper_pro_5000wx_processors (all versions)`\n- `athlon_3000_series_mobile_processors_with_radeon_graphics (all versions)`\n- `athlon_3000_series_mobile_processors_with_radeon_graphics (all versions)`\n- `ryzen_3000_series_mobile_processor_with_radeon_graphics (all versions)`\n- `ryzen_4000_series_mobile_processors_with_radeon_graphics (all versions)`\n- `ryzen_5000_series_mobile_processors_with_radeon_graphics (all versions)`\n- `ryzen_5000_series_mobile_processors_with_radeon_graphics (all versions)`\n- `ryzen_7020_series_processors_with_radeon_graphics (all versions)`\n- `ryzen_6000_series_processors_with_radeon_graphics (all versions)`\n- `ryzen_7035_series_processors_with_radeon_graphics (all versions)`\n- `ryzen_5000_series_processors_with_radeon_graphics (all versions)`\n- `ryzen_3000_series_processors_with_radeon_graphics (all versions)`\n- `ryzen_7040_series_processors_with_radeon_graphics (all versions)`\n- `ryzen_7045_series_mobile_processors (all versions)`\n- `epyc_embedded_3000 (all versions)`\n- `epyc_embedded_7002 (all versions)`\n- `epyc_embedded_7003 (all versions)`\n- `epyc_embedded_9003 (all versions)`\n- `ryzen_embedded_r1000 (all versions)`\n- `ryzen_embedded_r2000 (all versions)`\n- `ryzen_embedded_5000 (all versions)`\n- `ryzen_embedded_v1000 (all versions)`\n- `ryzen_embedded_v2000 (all versions)`\n- `ryzen_embedded_v3000 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}