CVE-2025-48520: AMD PMF Driver Information Disclosure Flaw

CVE-2025-48520 Overview

CVE-2025-48520 is an improper input validation vulnerability in the AMD Platform Management Framework (PMF) driver. The flaw enables a local attacker with low privileges to trigger an out-of-bounds read condition [CWE-125]. Successful exploitation can result in information disclosure or a system crash leading to denial of service.

The vulnerability requires local access and low-privileged authentication on the target system. No user interaction is required to trigger the condition. AMD documented the issue in security bulletin AMD-SB-4015.

Critical Impact

A local attacker with low privileges can read memory outside allocated buffer boundaries in the AMD PMF driver, exposing sensitive kernel data or crashing the affected system.

Affected Products

• AMD Platform Management Framework (PMF) driver
• AMD client platforms shipping the PMF driver component
• Refer to AMD Security Bulletin AMD-SB-4015 for the authoritative affected product list

Discovery Timeline

• 2026-05-15 - CVE-2025-48520 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2025-48520

Vulnerability Analysis

The AMD Platform Management Framework (PMF) driver mediates power and thermal management between firmware and the operating system on AMD client platforms. The driver exposes interfaces that accept input from user-mode components running on the host.

The vulnerability stems from missing or insufficient validation of input parameters before the driver performs a memory read operation. When the driver processes a request with attacker-controlled length or offset values, the read can cross the boundary of the intended buffer. This produces an out-of-bounds read condition classified under [CWE-125].

An attacker exploiting this condition can disclose adjacent memory contents back to a user-mode caller. Disclosed bytes may contain kernel pointers, cryptographic material, or other sensitive state useful for chaining further attacks. Alternatively, reading unmapped memory triggers a fault and crashes the host, producing a denial of service.

Root Cause

The driver fails to validate the size or offset of input supplied to a PMF interface before dereferencing it during a read. Because the check is missing, the kernel reads memory outside the bounds of the source buffer.

Attack Vector

Exploitation requires local access and a low-privileged account on the affected system. The attacker issues crafted requests to the PMF driver interface from user mode. No user interaction is required, and the attack complexity is low.

No public proof-of-concept exploit is available at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is 0.016%.

See the AMD Security Bulletin AMD-SB-4015 for vendor technical details.

Detection Methods for CVE-2025-48520

Indicators of Compromise

• Unexpected crashes, bug checks, or kernel faults referencing the AMD PMF driver module on affected endpoints
• Repeated user-mode process invocations issuing unusual IOCTL or device control requests to the AMD PMF device interface
• Anomalous memory access exceptions originating from the PMF driver in Windows Event Log or kernel crash dumps

Detection Strategies

• Monitor endpoint telemetry for process executions that open handles to the AMD PMF driver device and issue control codes with abnormal input lengths
• Correlate kernel crash dump signatures (BugCheck codes referencing the PMF driver) across the fleet to identify exploitation attempts or instability
• Inventory installed AMD PMF driver versions across managed endpoints and flag hosts running versions listed as vulnerable in AMD-SB-4015

Monitoring Recommendations

• Ingest Windows kernel crash and WER (Windows Error Reporting) telemetry into a central log platform for analysis
• Alert on driver loads, unloads, and version mismatches for the AMD PMF driver across managed devices
• Track low-privileged process activity that interacts with kernel device objects exposed by power and thermal management drivers

How to Mitigate CVE-2025-48520

Immediate Actions Required

• Apply the updated AMD PMF driver provided by AMD or the system OEM as soon as it is available for the affected platform
• Identify all endpoints running the AMD PMF driver and prioritize patching for multi-user systems and shared workstations
• Restrict local logon to trusted users on affected systems until the patched driver is deployed

Patch Information

AMD addresses this vulnerability through driver updates distributed via AMD Security Bulletin AMD-SB-4015. Patched driver versions are delivered through AMD chipset and platform driver packages, and through OEM-specific update channels for laptops and prebuilt systems. Validate the installed PMF driver version after deployment to confirm remediation.

Workarounds

• No vendor-documented workaround replaces the driver update; apply the patch as the primary remediation
• Where patching is delayed, limit local user accounts and enforce least privilege to reduce the population of users able to invoke the vulnerable interface
• Disable or remove the AMD PMF driver on systems where the power and thermal management functionality is not required, after testing for operational impact

# Verify AMD PMF driver version on Windows endpoints
pnputil /enum-drivers | findstr /i "amdpmf"

# List loaded driver and check file version
driverquery /v /fo list | findstr /i "PMF"