CVE-2023-31343

HIGH

Published Feb 11, 2025 Modified Apr 15, 2026 CWE-1220

Description

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution.

Is your site exposed to CVE-2023-31343?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-1220 CWE-1220

References

Other References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3009.html https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4008.html https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5004.html

Frequently Asked Questions

What is CVE-2023-31343? +

Improper input validation in the SMM handler may allow a privileged attacker to overwrite SMRAM, potentially leading to arbitrary code execution. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2023-31343? +

CVE-2023-31343 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2023-31343? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-54504

Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker …

CVE-2021-46747

Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application …

CVE-2026-78230

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, …

CVE-2026-78216

AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, …

CVE-2026-103509

P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on …

CVE-2026-0455

The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block …