THE CRUNCH

Intel and AMD have published more than 50 security advisories between them, describing over 200 vulnerabilities across their chips, firmware and supporting software. Fixes are out for most of the flaws, but not all: some AMD mitigations shipped months or even years ago, others are still in the works, and Intel has discontinued one affected product entirely.

Intel's 24 advisories cover just over 100 flaws, three of them critical and 20 high severity. The biggest single advisory details 30 holes in the TDX Migration Trust Domain (MigTD) reference software, including three critical authentication issues that allow privilege escalation. One of them, CVE-2026-61887, could also permit remote code execution. Other high-severity fixes cover Slim Bootloader, the UEFI firmware of two server boards, VTune Profiler, and denial-of-service flaws in Intel's PROSet/Wireless WiFi and Bluetooth products and its Performance Counter Monitor.

There is one notable exception to the patching: three medium-severity privilege escalation bugs in BigDL, an Intel product that has been discontinued, will not be fixed. Intel is advising users to uninstall it or stop using it as soon as possible.

AMD's 29 bulletins and two security briefs cover roughly 100 unique CVEs, none rated critical. Graphics dominate, with one bulletin describing 44 issues in Radeon and Instinct products, ten of them high severity. On the firmware side, AMD flagged a high-severity UEFI flaw letting a privileged attacker run arbitrary code in System Management Mode, a way to bypass Secure Debug Unlock protections, and an IOMMU bug a malicious guest virtual machine could use to cause a denial of service. More than two dozen medium-severity issues touch its Secure Encrypted Virtualization feature.

Some of AMD's publications tie back to academic and industry research, including extra mitigations for Transient Scheduler Attacks on Zen 5 processors, which the company says are affected differently than older CPUs. Researchers from ETH Zurich and Google reported that missing EDK II mitigations could let a privileged attacker infer the contents of System Management Mode memory.