Security readout for executives and security teams
A flaw in AMD Zen 2 processors lets an attacker who already has a low-privilege foothold on a system corrupt instructions run at a higher privilege level, which could hand them administrator or kernel control. It affects a wide range of EPYC server, Ryzen desktop, mobile, Threadripper, and embedded CPUs. Fixes come from AMD as firmware/microcode updates delivered by system vendors and hypervisor updates from projects like Xen. Broad across AMD Zen 2 fleets: EPYC 7002 and Embedded 7002 servers, Ryzen 3000/4000 desktop, Ryzen 4000/5000/7020/7030 mobile with Radeon graphics, Threadripper PRO 3000WX, and Embedded V2000/V2000A. Multi-tenant hypervisor hosts and shared workstations are highest exposure. Treat as a scheduled but firm priority: not a drop-everything emergency, but Zen 2 servers—especially virtualization hosts and multi-tenant workloads—should be included in the next firmware and hypervisor maintenance window. Delay increases risk if a working local privilege escalation is published. Mitigation focus: Inventory Zen 2 systems against the AMD SB-7052 product list to scope exposure.; Apply vendor BIOS/UEFI updates containing the AGESA versions AMD lists per family.; Deploy OS microcode updates from Linux distributions and Windows once available..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1189: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-1220: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-54518 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——AMDCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9redhat-SADPVulnerability scoring details
Base CVSS 4.0 score
7.3HighVector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-15T05:01:27.379Z: Reported to Red Hat.
- 2026-05-15T03:06:30.822Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7052.htmlCVE reference, AMD
- https://access.redhat.com/security/cve/CVE-2025-54518CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2477784CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-54518.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
Improper Isolation of Shared Resources on System-on-a-Chip (SoC) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Insufficient Granularity of Access Control
Insufficient Granularity of Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.