---
id: CVE-2023-20577
title: >-
  A heap overflow in SMM module may allow an attacker with access to a second
  vulnerability that enables writing to SPI flash, potentially resulting in
  arbitrary code execution.
summary: >-
  A heap overflow in SMM module may allow an attacker with access to a second
  vulnerability that enables writing to SPI flash, potentially resulting in
  arbitrary code execution.
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-121
vendor: AMD
product: 2nd Gen AMD EPYC™ Processors
affected:
  - 2nd_gen_amd_epyc_processors (all versions)
  - 3rd_gen_amd_epyc_processors (all versions)
  - 4th_gen_amd_epyc_processors (all versions)
  - instinct_mi300a (all versions)
  - ryzen_3000_series_desktop_processors (all versions)
  - ryzen_5000_series_desktop_processors (all versions)
  - ryzen_5000_series_desktop_processors_with_radeon_graphics (all versions)
  - ryzen_7000_series_processors (all versions)
  - athlon_3000_series_desktop_processors_with_radeon_graphics (all versions)
  - ryzen_4000_series_desktop_processors_with_radeon_graphics (all versions)
  - ryzen_threadripper_3000_series_processors (all versions)
  - ryzen_threadripper_pro_3000wx_series_processors (all versions)
  - ryzen_threadripper_pro_5000wx_processors (all versions)
  - athlon_3000_series_mobile_processors_with_radeon_graphics (all versions)
  - athlon_3000_series_mobile_processors_with_radeon_graphics (all versions)
  - ryzen_3000_series_mobile_processor_with_radeon_graphics (all versions)
  - ryzen_4000_series_mobile_processors_with_radeon_graphics (all versions)
  - ryzen_5000_series_mobile_processors_with_radeon_graphics (all versions)
  - ryzen_5000_series_mobile_processors_with_radeon_graphics (all versions)
  - ryzen_7020_series_processors_with_radeon_graphics (all versions)
  - ryzen_6000_series_processors_with_radeon_graphics (all versions)
  - ryzen_7035_series_processors_with_radeon_graphics (all versions)
  - ryzen_5000_series_processors_with_radeon_graphics (all versions)
  - ryzen_3000_series_processors_with_radeon_graphics (all versions)
  - ryzen_7040_series_processors_with_radeon_graphics (all versions)
  - ryzen_7045_series_mobile_processors (all versions)
  - epyc_embedded_3000 (all versions)
  - epyc_embedded_7002 (all versions)
  - epyc_embedded_7003 (all versions)
  - epyc_embedded_9003 (all versions)
  - ryzen_embedded_r1000 (all versions)
  - ryzen_embedded_r2000 (all versions)
  - ryzen_embedded_5000 (all versions)
  - ryzen_embedded_v1000 (all versions)
  - ryzen_embedded_v2000 (all versions)
  - ryzen_embedded_v3000 (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-03T03:56:43.507455Z'
published: '2026-09-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T15:02:34.068Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-20577'
references:
  - url: >-
      https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7009.html
tags:
  - cve.org
epss: 0.00152
epssPercentile: 0.0443
ingestedAt: '2026-11-05T19:30:42.973Z'
---

## Overview

A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.

## Affected

- `2nd_gen_amd_epyc_processors (all versions)`
- `3rd_gen_amd_epyc_processors (all versions)`
- `4th_gen_amd_epyc_processors (all versions)`
- `instinct_mi300a (all versions)`
- `ryzen_3000_series_desktop_processors (all versions)`
- `ryzen_5000_series_desktop_processors (all versions)`
- `ryzen_5000_series_desktop_processors_with_radeon_graphics (all versions)`
- `ryzen_7000_series_processors (all versions)`
- `athlon_3000_series_desktop_processors_with_radeon_graphics (all versions)`
- `ryzen_4000_series_desktop_processors_with_radeon_graphics (all versions)`
- `ryzen_threadripper_3000_series_processors (all versions)`
- `ryzen_threadripper_pro_3000wx_series_processors (all versions)`
- `ryzen_threadripper_pro_5000wx_processors (all versions)`
- `athlon_3000_series_mobile_processors_with_radeon_graphics (all versions)`
- `athlon_3000_series_mobile_processors_with_radeon_graphics (all versions)`
- `ryzen_3000_series_mobile_processor_with_radeon_graphics (all versions)`
- `ryzen_4000_series_mobile_processors_with_radeon_graphics (all versions)`
- `ryzen_5000_series_mobile_processors_with_radeon_graphics (all versions)`
- `ryzen_5000_series_mobile_processors_with_radeon_graphics (all versions)`
- `ryzen_7020_series_processors_with_radeon_graphics (all versions)`
- `ryzen_6000_series_processors_with_radeon_graphics (all versions)`
- `ryzen_7035_series_processors_with_radeon_graphics (all versions)`
- `ryzen_5000_series_processors_with_radeon_graphics (all versions)`
- `ryzen_3000_series_processors_with_radeon_graphics (all versions)`
- `ryzen_7040_series_processors_with_radeon_graphics (all versions)`
- `ryzen_7045_series_mobile_processors (all versions)`
- `epyc_embedded_3000 (all versions)`
- `epyc_embedded_7002 (all versions)`
- `epyc_embedded_7003 (all versions)`
- `epyc_embedded_9003 (all versions)`
- `ryzen_embedded_r1000 (all versions)`
- `ryzen_embedded_r2000 (all versions)`
- `ryzen_embedded_5000 (all versions)`
- `ryzen_embedded_v1000 (all versions)`
- `ryzen_embedded_v2000 (all versions)`
- `ryzen_embedded_v3000 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.