Intel and AMD have published more than 50 new security advisories that describe over 200 vulnerabilities affecting their products.
Fixes are available for most of the flaws, but not all. Some AMD mitigations were released months or even years ago, others are still in the works, and Intel has discontinued one of the impacted products.
Intel publishes 24 advisories covering more than 100 flaws
Intel’s 24 new advisories describe just over 100 vulnerabilities. Three of them are rated ‘critical’ and 20 are rated ‘high severity’.
The largest advisory covers 30 security holes in the TDX Migration Trust Domain (MigTD) reference software. They include three critical authentication issues that can be exploited for privilege escalation. One of them, CVE-2026-61887, could also allow remote code execution.
High-severity privilege escalation vulnerabilities have been addressed in Slim Bootloader, the UEFI firmware of the D50DNP and M50FCP server boards, and the VTune Profiler software.
Intel also fixed high-severity flaws that can be exploited for denial-of-service (DoS) attacks in its PROSet/Wireless WiFi and Bluetooth products, and in the Performance Counter Monitor (PCM) software.
No patches are being released for three medium-severity privilege escalation bugs in BigDL, which has been discontinued. Intel is advising users to “uninstall it or discontinue use as soon as possible”.
Medium-severity issues that can lead to privilege escalation or DoS were resolved in graphics drivers, NPU drivers, QAT drivers for Windows, Neural Compressor, Hyperscan, oneDNN, the oneAPI CLI Tool, TDX Workload Attestation, and the Metrics Discovery API.
The remaining advisories cover medium-severity flaws in Application Optimization, Media Transcode Accelerator, Multi-Buffer Crypto for IPSec, ISA-L, the Computing Improvement Program, and Platform Monitoring Technology. A low-severity bug was fixed in AI Playground.
AMD releases 29 bulletins and two security briefs
AMD this week published 29 security bulletins and two security briefs. They cover roughly 100 unique CVEs, including a few that are not specific to AMD.
None of the flaws have been assigned a ‘critical’ CVSS score. In many cases the mitigations have been available for some time, while other updates are only expected in the coming weeks or months, some as late as 2027.
Graphics products account for the largest share of the vulnerabilities. One bulletin describes 44 issues affecting Radeon and Instinct products, including ten with a high severity score.
On the firmware side, AMD informed customers about a high-severity UEFI vulnerability that could allow a privileged attacker to execute arbitrary code in System Management Mode (SMM). Another high-severity flaw can be exploited to bypass Secure Debug Unlock protections.
Two other high-severity issues are described in a single bulletin. One is an IOMMU flaw that an attacker in control of a guest VM could exploit to cause a DoS condition, and the other is a TianoCore EDK II bug that can lead to SMM memory corruption.
High-severity issues were also addressed in AMD Management Console, where a missing authentication flaw could expose stored credentials, and in the Vivado Lab Solutions software, which is affected by a privilege escalation bug.
More than two dozen medium-severity vulnerabilities impact Secure Encrypted Virtualization (SEV).
Several of AMD’s publications are tied to academic and industry research. One bulletin provides additional mitigations for Transient Scheduler Attacks (TSA) on Zen 5 processors, which the company found are affected differently than older CPUs. Researchers from ETH Zurich and Google reported that TSA mitigations missing from EDK II could allow a privileged attacker to infer SMM memory contents.
Other bulletins describe medium- and low-severity flaws in the AMD Secure Processor, IOMMU, NBIO, power management firmware, RAIDXpert2, an embedded SPI flash driver, Bootgen, and Versal adaptive SoCs, as well as a transient execution issue.
A separate bulletin covers an InstallShield privilege escalation vulnerability that affects AMD Management Console.
Related: Chipmaker Patch Tuesday: Intel and AMD Patch 70 Vulnerabilities
Related: Chipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities Combined
