AMD EPYC Fabricked Vulnerability Lets Cloud Hosts Read VM Memory

Researchers at ETH Zurich have disclosed a security vulnerability in AMD's EPYC processors. The flaw, named Fabricked, targets AMD's Infinity Fabric and SEV-SNP technology. It allows a malicious cloud host to read and write confidential virtual machine memory.

Exploit targets Zen 3-5 EPYC processors

The vulnerability affects EPYC processors across the Zen 3, Zen 4, and Zen 5 architectures. The exploit is software-only and fully deterministic, with a 100% success rate according to the researchers. AMD has assigned CVE-2025-54510 and released advisory AMD-SB-3034.

The attack bypasses hardware security protections designed to isolate guest VMs from the host. It can also forge attestation reports, undermining trust in confidential computing environments. The exploit does not require physical access or specialized hardware.

AMD has not confirmed a timeline for firmware or microcode updates. The vulnerability affects a wide range of EPYC processors used in cloud data centers. Customers should review AMD's advisory for mitigation guidance.