CVE-2025-29937: AMD PMF Out of Bounds Read Vulnerability

CVE-2025-29937 Overview

CVE-2025-29937 is an out-of-bounds read vulnerability [CWE-125] in the AMD Platform Management Framework (PMF). The flaw allows a local attacker with low privileges to trigger a read from an arbitrary memory location. Successful exploitation can result in loss of availability or confidentiality on affected systems.

The vulnerability requires local access and low privileges, with no user interaction needed. AMD has published a security bulletin tracking the issue as AMD-SB-4015. The vulnerability primarily impacts system availability, with secondary risk of information disclosure through memory contents read outside intended bounds.

Critical Impact
A local authenticated attacker can trigger arbitrary memory reads through the AMD PMF driver, leading to denial of service or disclosure of sensitive kernel memory contents.

Affected Products

AMD Platform Management Framework (PMF) driver
AMD client platforms shipping with PMF support
Refer to AMD Security Bulletin AMD-SB-4015 for the complete affected product list

Discovery Timeline

2026-05-15 - CVE-2025-29937 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2025-29937

Vulnerability Analysis

The vulnerability resides within the AMD Platform Management Framework, a driver and firmware framework that coordinates power, thermal, and performance management on AMD client platforms. PMF exposes interfaces that the operating system uses to query and configure platform telemetry.

An out-of-bounds read condition [CWE-125] exists in how PMF processes input data when accessing memory buffers. The driver fails to properly validate index or length parameters before performing a read operation. As a result, the read can extend beyond the bounds of the intended buffer into adjacent memory.

Because PMF runs with elevated platform privileges, the disclosed memory may contain sensitive kernel data, cryptographic material, or driver state. The same condition can also cause the driver to fault, producing a denial-of-service outcome on the host.

Root Cause

The root cause is missing or insufficient bounds checking on attacker-controlled parameters passed to PMF read paths. When these parameters are not validated against the size of the underlying buffer, the driver dereferences memory outside the allocated region.

Attack Vector

Exploitation requires local access and low-privileged authenticated access on the target system. An attacker interacts with the PMF interface, supplying crafted parameters that cause the driver to read from an arbitrary memory location. No user interaction is required. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.016%, indicating low likelihood of exploitation in the near term.

No verified public exploit code is available. Technical details are described in the AMD Security Bulletin.

Detection Methods for CVE-2025-29937

Indicators of Compromise

Unexpected crashes or bug checks referencing the AMD PMF driver in Windows Event Logs or kernel crash dumps
Loading of the PMF driver by unprivileged or unusual user processes
Anomalous IOCTL traffic targeting the PMF device interface from non-standard processes

Detection Strategies

Monitor kernel-mode driver telemetry for repeated faults or exceptions originating in the PMF driver module
Build behavioral rules that flag local processes issuing high volumes of device control requests to platform management interfaces
Correlate driver load events with process lineage to identify unexpected callers of PMF

Monitoring Recommendations

Enable Windows Error Reporting and forward kernel crash artifacts to a centralized analytics platform for review
Track patch state of AMD chipset and PMF drivers across the fleet using endpoint inventory tooling
Alert on privilege-context anomalies where standard users interact with platform management device objects

How to Mitigate CVE-2025-29937

Immediate Actions Required

Apply the AMD-supplied PMF driver and firmware updates referenced in AMD-SB-4015 as soon as they are available for your platform
Inventory AMD client systems to identify hosts running vulnerable PMF driver versions
Restrict local logon and limit the number of standard users on shared or kiosk systems running affected hardware

Patch Information

AMD has published mitigation guidance in AMD Security Bulletin AMD-SB-4015. System administrators should obtain updated PMF driver packages from the OEM or AMD support channel and deploy them through standard patch management workflows. Verify driver version after installation to confirm remediation.

Workarounds

Where patching is not immediately feasible, restrict interactive logon to trusted administrators on affected endpoints
Disable the PMF driver only after confirming that platform power and thermal management can be handled by alternate mechanisms, as disabling may degrade system behavior
Apply application allow-listing to reduce the ability of arbitrary local code to interact with the PMF device interface

bash

# Verify AMD PMF driver presence and version on Windows
pnputil /enum-drivers | findstr /I "AMD PMF"
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*AMD PMF*" } | Select-Object DeviceName, DriverVersion, DriverDate