Intel and AMD Address More Than 200 Vulnerabilities in New Advisories
Summary
Intel and AMD published more than 50 advisories covering over 200 vulnerabilities. Fixes are available for most, but some mitigations remain pending, and Intel recommends discontinuing use of affected BigDL software.
Key points
- Intel’s 24 advisories cover just over 100 vulnerabilities, including three critical flaws in TDX Migration Trust Domain reference software; CVE-2026-61887 could allow remote code execution.
- Intel released no patches for three privilege-escalation bugs in discontinued BigDL and advises users to stop using the software.
- AMD published 29 bulletins and two briefs covering roughly 100 CVEs; some mitigations have been available for months or years, while other updates are still expected.
- AMD reported a high-severity UEFI flaw that could let a privileged attacker execute code in System Management Mode, along with a separate flaw that can bypass Secure Debug Unlock protections.
- AMD’s advisories also cover a guest-VM-triggered IOMMU denial-of-service flaw and a TianoCore EDK II bug that can cause SMM memory corruption.
- Research-related advisories address Transient Scheduler Attacks on Zen 5 and missing EDK II mitigations that could let a privileged attacker infer SMM memory contents.
Article Details
- Event Type
- Security advisory and vulnerability disclosure
- Impact
- Intel and AMD disclosed more than 200 vulnerabilities affecting their products. Reported consequences include remote code execution, privilege escalation, denial of service, credential exposure, bypass of Secure Debug Unlock protections, and disclosure or corruption of SMM memory. One critical TDX Migration Trust Domain issue, CVE-2026-61887, could allow remote code execution.
CVE
Vendors
Products
AMD Management ConsoleHigh-severity issues were also addressed in AMD Management Console, where a missing authentication flaw could expose stored credentials, and in the Vivado Lab Solutions software, which is affected by a privilegeBigDLNo patches are being released for three medium-severity privilege escalation bugs in BigDL, which has been discontinued.D50DNPHigh-severity privilege escalation vulnerabilities have been addressed in Slim Bootloader, the UEFI firmware of the D50DNP and M50FCP server boards, and the VTune Profiler software.EDK IIOne is an IOMMU flaw that an attacker in control of a guest VM could exploit to cause a DoS condition, and the other is a TianoCore EDK II bug that can lead to SMM memory corruption.InstinctOne bulletin describes 44 issues affecting Radeon and Instinct products, including ten with a high severity score.M50FCPHigh-severity privilege escalation vulnerabilities have been addressed in Slim Bootloader, the UEFI firmware of the D50DNP and M50FCP server boards, and the VTune Profiler software.RadeonOne bulletin describes 44 issues affecting Radeon and Instinct products, including ten with a high severity score.Secure Encrypted Virtualization (SEV)More than two dozen medium-severity vulnerabilities impact Secure Encrypted Virtualization (SEV).Slim BootloaderHigh-severity privilege escalation vulnerabilities have been addressed in Slim Bootloader, the UEFI firmware of the D50DNP and M50FCP server boards, and the VTune Profiler software.TDX Migration Trust Domain (MigTD) reference softwareThe largest advisory covers 30 security holes in the TDX Migration Trust Domain (MigTD) reference software.Vivado Lab SolutionsConsole, where a missing authentication flaw could expose stored credentials, and in the Vivado Lab Solutions software, which is affected by a privilege escalation bug.