AMD SMM Module Heap Overflow Enables Arbitrary Code via SPI Flash
CVE-2023-20577 Published on September 2, 2026

A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.

NVD

Vulnerability Analysis

CVE-2023-20577 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:

LOCAL

Attack Complexity:

HIGH

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

HIGH

Weakness Type

What is a Stack Overflow Vulnerability?

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

CVE-2023-20577 has been classified to as a Stack Overflow vulnerability or weakness.

Affected Versions

2nd Gen AMD EPYC™ Processors:

Version RomePI 1.0.0.H is unaffected.

3rd Gen AMD EPYC™ Processors:

Version MilanPI 1.0.0.C is unaffected.

4th Gen AMD EPYC™ Processors:

Version GenoaPI 1.0.0.8 is unaffected.

AMD Instinct™ MI300A:

Version MI300 SR5 PI 1.0.0.1 is unaffected.

AMD Ryzen™ 3000 Series Desktop Processors:

Version ComboAM4v2 1.2.0.B is unaffected.
Version ComboAM4 1.0.0.B is unaffected.

AMD Ryzen™ 5000 Series Desktop Processors:

Version ComboAM4v2 1.2.0.B is unaffected.

AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics:

Version ComboAM4v2 1.2.0.B is unaffected.

AMD Ryzen™ 7000 Series Processors:

Version ComboAM5 1.0.0.7b is unaffected.

AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics:

Version ComboAM4v2 1.2.0.B is unaffected.
Version ComboAM4 1.0.0.B is unaffected.

AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics:

Version ComboAM4v2 1.2.0.B is unaffected.

AMD Ryzen™ Threadripper™ 3000 Series Processors:

Version CastlePeakPI-SP3r3 1.0.0.A is unaffected.

AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors:

Version ChagallWSPI-sWRX8 1.0.0.7 is unaffected.
Version CastlePeakWSPI-sWRX8 1.0.0.C is unaffected.

AMD Ryzen™ Threadripper™ PRO 5000WX Processors:

Version ChagallWSPI-sWRX8 1.0.0.7 is unaffected.

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics:

Version PicassoPI-FP5 1.0.1.0 is unaffected.

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics:

Version PollockPI-FT5 1.0.0.6 is unaffected.

AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics:

Version PicassoPI-FP5 1.0.1.0 is unaffected.

AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics:

Version RenoirPI-FP6 1.0.0.D is unaffected.

AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics:

Version CezannePI-FP6 1.0.0.F is unaffected.

AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics:

Version CezannePI-FP6 1.0.0.F is unaffected.

AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics:

Version MendocinoPI-FT6 1.0.0.6 is unaffected.

AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics:

Version RembrandtPI-FP7 1.0.0.9b is unaffected.

AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics:

Version RembrandtPI-FP7 1.0.0.9b is unaffected.

AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics:

Version CezannePI-FP6 1.0.0.F is unaffected.

AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics:

Version CezannePI-FP6 1.0.0.F is unaffected.

AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics:

Version PhoenixPI-FP8-FP7 1.0.0.2 is unaffected.

AMD Ryzen™ 7045 Series Mobile Processors:

Version DragonRangeFL1PI 1.0.0.3a is unaffected.

AMD EPYC™ Embedded 3000:

Version Snowyowl PI 1.1.0.B is unaffected.

AMD EPYC™ Embedded 7002:

Version EmbRomePI-SP3 1.0.0.B is unaffected.

AMD EPYC™ Embedded 7003:

Version EmbMilanPI-SP3 1.0.0.8 is unaffected.

AMD EPYC™ Embedded 9003:

Version EmbGenoaPI-SP5 1.0.0.3 is unaffected.

AMD Ryzen™ Embedded R1000:

Version EmbeddedPI-FP5 1.2.0.A is unaffected.

AMD Ryzen™ Embedded R2000:

Version EmbeddedPI-FP5 1.0.0.2 is unaffected.

AMD Ryzen™ Embedded 5000:

Version EmbAM4PI 1.0.0.4 is unaffected.

AMD Ryzen™ Embedded V1000:

Version EmbeddedPI-FP5 1.2.0.A is unaffected.

AMD Ryzen™ Embedded V2000:

Version EmbeddedPI-FP6 1.0.0.9 is unaffected.

AMD Ryzen™ Embedded V3000:

Version EmbeddedPI-FP7r2 1.0.0.8 is unaffected.

AMD SMM Module Heap Overflow Enables Arbitrary Code via SPI FlashCVE-2023-20577 Published on September 2, 2026

Vulnerability Analysis

Weakness Type

What is a Stack Overflow Vulnerability?

Affected Versions

AMD SMM Module Heap Overflow Enables Arbitrary Code via SPI Flash
CVE-2023-20577 Published on September 2, 2026