{"id":"CVE-2025-0038","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-0038","generatedAt":"2026-10-28T03:59:40.585Z","title":"In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or protected memory spaces resulting in the loss of integrity and confidentiality.","description":"In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or protected memory spaces resulting in the loss of integrity and confidentiality.","published":"2025-10-06T17:16:03.000Z","lastModified":"2026-10-18T21:10:00.000Z","status":"Deferred","sourceIdentifier":"psirt@amd.com","cvss":{"version":"3.1","score":6.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H"},"cwe":["CWE-1284"],"affected":[],"epss":{"score":0.00129,"percentile":0.02519,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8008.html","source":"psirt@amd.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-0038","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}