AMD vulnerabilities
491 CVEs and advisories name AMD as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-43598Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent a
- CVE-2026-0461Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded
- CVE-2026-0482In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow craf
- CVE-2023-20577A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially…
- CVE-2023-20576Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of ser
- CVE-2023-31308A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory rea
- CVE-2023-20511Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potent
- CVE-2025-54512A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges,
- CVE-2026-0465A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potential
- CVE-2025-0046Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.
- CVE-2025-8087A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstall
- CVE-2025-48505Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged e
- CVE-2025-48506Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths,
- CVE-2025-61970Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary cod
- CVE-2025-0041Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user
- CVE-2026-43606Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially pe
- CVE-2023-20572An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authe
- CVE-2023-20540An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authe
- CVE-2026-40677The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially lead
- CVE-2024-21944Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys
- CVE-2026-28237Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of ava
- CVE-2026-0466Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potential
- CVE-2025-54509Improper access control for register interface in the Input-Output Memory Management Unit (IOMMU) could allow a privileged attacker to cause
- CVE-2021-46747Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to m
- CVE-2024-36343Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of b
- CVE-2025-54518Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instruction
- CVE-2026-0481Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized ch
- CVE-2024-21950An out of bounds read in the remote management firmware could allow a privileged attacker read a limited section of memory outside of establ
- CVE-2025-52532A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd
- CVE-2024-36323Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized acc