Amperecomputing produces a focused line of ARM-based server processors and firmware for data-center deployment, with its vulnerability profile concentrated in the Ampere Altra and AmpereOne processor families and their associated firmware components. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and reflect the memory-safety and access-control demands inherent to processor firmware, including out-of-bounds writes and improper privilege boundaries. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Amperecomputing over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-32295CRITICAL On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor component. | Jul 1, 2022 | 9.8 | 31 | NO | NO |
CVE-2025-62864CRITICAL Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM MMCommun | Dec 16, 2025 | 9.8 | 30 | NO | NO |
CVE-2025-62863CRITICAL Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM PCIe dri | Dec 16, 2025 | 9.8 | 30 | NO | NO |
CVE-2021-45454HIGH Ampere Altra before SRP 1.08b and Altra Max before SRP 2.05 allow information disclosure of power telemetry via HWmon. | Aug 17, 2022 | 7.5 | 25 | NO | NO |
CVE-2022-46892CRITICAL In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex. | Feb 15, 2023 | 9.8 | 24 | NO | NO |
CVE-2022-37459HIGH Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hijack code flow to exec | Aug 17, 2022 | 7.8 | 24 | NO | NO |
CVE-2025-62862MEDIUM Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorrectly formed SMC call to UEFI-MM Boot Err | Dec 16, 2025 | 4.6 | 18 | NO | NO |
CVE-2022-25368MEDIUM Spectre BHB is a variant of Spectre-v2 in which malicious code uses the shared branch history (stored in the CPU BHB) to influence mispredicted branches in the victim's hardware co | Mar 10, 2022 | 4.7 | 18 | NO | NO |
CVE-2022-35888MEDIUM Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by cor | Sep 29, 2022 | 6.5 | 17 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Amperecomputing.
Media articles that mention a CVE ID that affects a product developed by Amperecomputing — matched by CVE ID, not by vendor name.