CVE-2024-21947

HIGH

Published Sep 6, 2025 Modified Apr 15, 2026 CWE-1220

Description

Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at the SMM level.

Is your site exposed to CVE-2024-21947?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-1220 CWE-1220

References

Other References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html

Frequently Asked Questions

What is CVE-2024-21947? +

Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at the SMM level. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2024-21947? +

CVE-2024-21947 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

How do I check if I'm vulnerable to CVE-2024-21947? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-103509

P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on …

CVE-2026-57892

Insufficient granularity of access control in the MigTD v2 policy evaluation engine for the Intel(R) TDX Migration Trust Domain (MigTD) …

CVE-2026-78230

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, …

CVE-2025-54504

Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges attacker …

CVE-2026-0455

The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block …

CVE-2021-46747

Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application …