CVE-2025-48513: AMD PMF Information Disclosure Flaw

CVE-2025-48513 Overview

CVE-2025-48513 is an uninitialized memory use vulnerability [CWE-908] in the AMD Platform Management Framework (PMF). The driver fails to initialize a kernel resource before exposing it to user-accessible operations. A local authenticated attacker can read uninitialized kernel memory, leading to loss of confidentiality or availability on affected AMD platforms.

The issue requires local access with low privileges and no user interaction. AMD has acknowledged the flaw in AMD Security Bulletin AMD-SB-4015.

Critical Impact

A local attacker with low privileges can disclose sensitive kernel memory contents or disrupt system availability through the AMD PMF driver.

Affected Products

• AMD Platform Management Framework (PMF) — refer to AMD-SB-4015 for the affected driver versions
• AMD client platforms shipping the PMF driver
• Systems running OEM builds that bundle the AMD PMF driver

Discovery Timeline

• 2026-05-15 - CVE-2025-48513 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2025-48513

Vulnerability Analysis

The AMD Platform Management Framework is a kernel-mode driver that coordinates thermal, power, and performance behavior between firmware and the operating system. CVE-2025-48513 stems from the driver using a resource before it has been fully initialized. When that resource is reachable from a user-mode caller, residual kernel memory contents are returned across the trust boundary.

Uninitialized memory disclosures of this class [CWE-908] frequently leak pointer values, stack canaries, or fragments of prior kernel allocations. Such data can defeat Kernel Address Space Layout Randomization (KASLR) and serve as a stepping stone for further local privilege escalation chains. The same uninitialized read path can also produce inconsistent state, leading to availability impact through driver or system instability.

Exploitation requires the attacker to already have code execution on the host with low privileges. No exploit is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is the use of an uninitialized resource inside the PMF driver. A buffer or structure is allocated in kernel space, then read or returned to a caller before all fields are populated with defined values. The leftover bytes reflect whatever data previously occupied that memory region.

Attack Vector

The attack vector is local. An authenticated user invokes the PMF driver interface — typically through device I/O control requests — and receives output containing uninitialized kernel memory. The vulnerability manifests entirely within the driver's request handling path; no network exposure exists. Refer to AMD-SB-4015 for technical specifics on the affected interface.

Detection Methods for CVE-2025-48513

Indicators of Compromise

• No public indicators of compromise have been published for CVE-2025-48513.
• Unexpected kernel crashes or bug checks referencing the AMD PMF driver module may indicate exploitation attempts.
• Anomalous patterns of device I/O control requests targeting the PMF driver from non-administrative processes.

Detection Strategies

• Inventory endpoints running the AMD PMF driver and compare installed driver versions against the fixed versions listed in AMD-SB-4015.
• Monitor for unsigned or unexpected user-mode processes issuing repeated DeviceIoControl calls to the AMD PMF device object.
• Correlate driver load events with kernel error telemetry to surface instability tied to PMF.

Monitoring Recommendations

• Collect Windows kernel telemetry (Event ID 41, bug check codes) and alert on faults attributed to the PMF driver.
• Track driver version inventory through endpoint management tooling and flag systems missing the AMD patch.
• Baseline normal PMF driver IOCTL traffic and alert on volume spikes from low-privilege user contexts.

How to Mitigate CVE-2025-48513

Immediate Actions Required

• Apply the updated AMD PMF driver published by AMD or your OEM as soon as it is available for your platform.
• Restrict local logon to trusted users and enforce least privilege to limit exposure to local-only vulnerabilities.
• Audit installed driver versions across the fleet and prioritize remediation on systems handling sensitive workloads.

Patch Information

AMD has published remediation guidance in AMD Security Bulletin AMD-SB-4015. Apply the fixed AMD PMF driver version referenced in that bulletin. OEM-distributed driver packages may be required on systems where the driver is delivered through vendor update channels rather than directly from AMD.

Workarounds

• If patching is not immediately feasible, disable the AMD PMF driver on systems where platform management features are not required.
• Block untrusted local user accounts and enforce application allowlisting to reduce the ability for low-privileged code to reach the driver interface.
• Apply standard hardening to limit local code execution vectors such as malicious documents and removable media.

# Verify AMD PMF driver presence and version on Windows
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*AMD PMF*" } | Select-Object DeviceName, DriverVersion, DriverDate

# Disable the PMF service if patching is not yet possible (test before deploying)
sc.exe config AMDPMF start= disabled