Intel and AMD Patch Over 200 Vulnerabilities, Including Critical Flaws in TDX and Graphics
Intel and AMD have released a significant wave of security updates, addressing more than 200 vulnerabilities across their product lines, with critical issues impacting Intel's confidential computing and AMD's graphics hardware.
Intel and AMD have collectively issued over 50 new security advisories, detailing more than 200 vulnerabilities affecting a wide range of their hardware and software products. While many of these flaws have received patches, some mitigations were released years ago, and others are still under development, with one Intel product being discontinued.
Intel's contribution includes 24 advisories covering over 100 vulnerabilities, three of which are rated 'critical' and twenty 'high severity.' A significant portion of these, 30 flaws, reside in the Intel Trust Domain Extensions (TDX) Migration Trust Domain (MigTD) reference software. Among these are critical authentication issues that could lead to privilege escalation, and one, CVE-2026-61887, which could enable remote code execution.
Further critical and high-severity vulnerabilities were patched in Intel's Slim Bootloader, server board firmware, and the VTune Profiler software. Denial-of-service (DoS) vulnerabilities were also addressed in Intel's PROSet/Wireless WiFi and Bluetooth products, as well as the Performance Counter Monitor (PCM) software. Notably, Intel is discontinuing a product with three medium-severity privilege escalation bugs, advising users to uninstall it.
AMD's security response comprises 29 bulletins and two security briefs, collectively addressing approximately 100 unique CVEs. While none of these received a 'critical' CVSS score, many high-severity issues were patched, particularly within its graphics product lines, including Radeon and Instinct. Updates for firmware also addressed a high-severity UEFI vulnerability allowing arbitrary code execution in System Management Mode (SMM) and flaws that could bypass Secure Debug Unlock protections.
Other high-severity vulnerabilities in AMD's portfolio include an IOMMU flaw exploitable from a guest virtual machine to cause a DoS, and an EDK II bug leading to SMM memory corruption. The AMD Management Console and Vivado Lab Solutions software also saw fixes for high-severity issues related to credential exposure and privilege escalation, respectively.
Beyond critical and high-severity flaws, AMD also addressed over two dozen medium-severity vulnerabilities impacting its Secure Encrypted Virtualization (SEV) technology. Several advisories were linked to academic research, including new mitigations for Transient Scheduler Attacks (TSA) on Zen 5 processors and fixes for missing TSA mitigations in EDK II that could expose SMM memory contents.
The scope of these updates underscores the persistent security challenges inherent in complex hardware and software ecosystems. The patching efforts by both Intel and AMD highlight the ongoing need for vigilance and timely updates to protect against a wide array of potential exploits, from privilege escalation and remote code execution to denial-of-service attacks.