A critical security vulnerability has been detected in AMD’s Ryzen 7000, 8000 and 9000 series processors. The vulnerability is caused by a lack of validation in the TPM-Pluton component in the processors. This vulnerability, which affects the Secure Platform Module (TPM) standard developed by the Trusted Computing Group, can allow attackers to read unauthorized data in system memory and, in some cases, lead to denial of service attacks.

A security vulnerability has emerged in AMD Ryzen processors

The vulnerability, tracked with the code CVE-2025-2884, was recorded as AMD-SB-4011 in AMD’s internal tracking. The vulnerability is caused by an insufficient validation check in the CryptHmacSign function used in the TPM module.

This flaw allows an attacker to read up to 65,535 bytes of additional data by overflowing the TPM memory on systems with physical access. Although the vulnerability is considered a limited threat due to the need for physical access, the security level is kept at a medium level. The CVSS score of the vulnerability was determined as 6.6.

AMD responded quickly to this vulnerability and released the AGESA Combo PI 1.2.0.3e firmware version. The update includes security improvements for the AMD Secure Processor (ASP) component associated with TPM-Pluton. In addition, changes that provide system-wide stability and performance improvements are also offered as part of the update.

Motherboard manufacturers also responded quickly to the update. MSI and ASUS released BIOS updates supporting the new AGESA version through official channels. Gigabyte, ASRock and other motherboard manufacturers are expected to share similar updates with users soon.

Users affected by the critical vulnerability are advised to update their systems without delay. So what do you think about this issue? You can share your opinions with us in the comments section below.