# CVE-2023-20577: CVE-2023-20577 Status: published. Published: 2026-09-02. Updated: 2026-11-03. A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution. ## Remediation No remediation reported in collected sources ## Affected products and versions - AMD / 2nd Gen AMD EPYC™ Processors: RomePI 1.0.0.H (unaffected). Source: CNA: AMD - AMD / 3rd Gen AMD EPYC™ Processors: MilanPI 1.0.0.C (unaffected). Source: CNA: AMD - AMD / 4th Gen AMD EPYC™ Processors: GenoaPI 1.0.0.8 (unaffected). Source: CNA: AMD - AMD / AMD Instinct™ MI300A: MI300 SR5 PI 1.0.0.1 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 3000 Series Desktop Processors: ComboAM4v2 1.2.0.B (unaffected); ComboAM4 1.0.0.B (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 5000 Series Desktop Processors: ComboAM4v2 1.2.0.B (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics: ComboAM4v2 1.2.0.B (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 7000 Series Processors: ComboAM5 1.0.0.7b (unaffected). Source: CNA: AMD - AMD / AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics: ComboAM4v2 1.2.0.B (unaffected); ComboAM4 1.0.0.B (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics: ComboAM4v2 1.2.0.B (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Threadripper™ 3000 Series Processors: CastlePeakPI-SP3r3 1.0.0.A (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors: ChagallWSPI-sWRX8 1.0.0.7 (unaffected); CastlePeakWSPI-sWRX8 1.0.0.C (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Threadripper™ PRO 5000WX Processors: ChagallWSPI-sWRX8 1.0.0.7 (unaffected). Source: CNA: AMD - AMD / AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics: PicassoPI-FP5 1.0.1.0 (unaffected). Source: CNA: AMD - AMD / AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics: PollockPI-FT5 1.0.0.6 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics: PicassoPI-FP5 1.0.1.0 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics: RenoirPI-FP6 1.0.0.D (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics: CezannePI-FP6 1.0.0.F (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics: MendocinoPI-FT6 1.0.0.6 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics: RembrandtPI-FP7 1.0.0.9b (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics: RembrandtPI-FP7 1.0.0.9b (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics: CezannePI-FP6 1.0.0.F (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics: CezannePI-FP6 1.0.0.F (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics: PhoenixPI-FP8-FP7 1.0.0.2 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ 7045 Series Mobile Processors: DragonRangeFL1PI 1.0.0.3a (unaffected). Source: CNA: AMD - AMD / AMD EPYC™ Embedded 3000: Snowyowl PI 1.1.0.B (unaffected). Source: CNA: AMD - AMD / AMD EPYC™ Embedded 7002: EmbRomePI-SP3 1.0.0.B (unaffected). Source: CNA: AMD - AMD / AMD EPYC™ Embedded 7003: EmbMilanPI-SP3 1.0.0.8 (unaffected). Source: CNA: AMD - AMD / AMD EPYC™ Embedded 9003: EmbGenoaPI-SP5 1.0.0.3 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Embedded R1000: EmbeddedPI-FP5 1.2.0.A (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Embedded R2000: EmbeddedPI-FP5 1.0.0.2 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Embedded 5000: EmbAM4PI 1.0.0.4 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Embedded V1000: EmbeddedPI-FP5 1.2.0.A (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Embedded V2000: EmbeddedPI-FP6 1.0.0.9 (unaffected). Source: CNA: AMD - AMD / AMD Ryzen™ Embedded V3000: EmbeddedPI-FP7r2 1.0.0.8 (unaffected). Source: CNA: AMD ## Severity and prioritization - CVSS 3.1: 7.4 (high); CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: AMD - CISA KEV: No listing in collected sources - EPSS: 0.15% as of 2026-11-03; percentile 4.42% - SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP - Weaknesses: CWE-121 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7009.html (CNA: AMD) ## Provenance - CNA: AMD: https://www.cve.org/CVERecord?id=CVE-2023-20577; retrieved 2026-11-03; source updated 2026-11-03 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2023-20577; retrieved 2026-11-03; source updated Not reported Revision: f6f95c047dcb5ab903e70a2b682bba90ccd0f4118bb6a9483a8756273d89d612 Canonical: https://y2.dev/cve/CVE-2023-20577 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.