AMD vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-43598 Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereferenHigh 7.7 · Oct 6, 2026
• CVE-2026-0461 Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware UpgrHigh 7.5 · Oct 5, 2026
• CVE-2023-20577 A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary High 7.4 · Sep 2, 2026
• CVE-2023-20576 Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege esHigh 7.7 · Sep 2, 2026
• CVE-2025-54512 A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resultinHigh 7 · Aug 11, 2026
• CVE-2025-0046 Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.High 7 · Aug 11, 2026
• CVE-2026-43606 Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysiHigh 8.5 · Aug 11, 2026
• CVE-2025-8087 A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potenHigh 7 · Aug 11, 2026
• CVE-2026-40677 The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary codHigh 7.7 · Jun 12, 2026
• CVE-2021-46747 Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN (SyHigh 7.1 · Jun 1, 2026
• CVE-2026-0481 Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU conCritical 9.2 · May 15, 2026
• CVE-2025-54518 Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a diffHigh 7.3 · May 15, 2026
• CVE-2024-36334 Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory to be run with elevateHigh 7 · May 15, 2026
• CVE-2024-36333 A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code executiHigh 7 · May 15, 2026
• CVE-2024-36323 Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized access to the register High 8.8 · May 15, 2026
• CVE-2025-54517 Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.High 8.5 · May 14, 2026
• CVE-2025-29938 An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address resulting in denialHigh 7.1 · May 14, 2026
• CVE-2025-29936 Improper input validation within the AMD Platform Management Framework (PMF) could allow an attacker to unmap arbitrary memory pages potentially impacting integHigh 8.4 · May 14, 2026
• CVE-2025-29935 An out of bounds write within the AMD Platform Management Framework (PMF) could allow an attacker to execute arbitrary code at an elevated privilege level potenHigh 8.4 · May 14, 2026
• CVE-2025-0028 An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an arbitrary address potentially resultiHigh 8.3 · May 14, 2026
• CVE-2024-21962 Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation High 8.6 · May 14, 2026
• CVE-2023-31317 Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or write to protected High 8.8 · May 14, 2026
• CVE-2023-31316 Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could allow an attacker wHigh 7.1 · May 14, 2026
• CVE-2026-0432 Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbiHigh 8.5 · May 14, 2026
• CVE-2025-52540 An improper input validation vulnerability within the AMD Platform Management Framework (PMF) Driver can allow a local attacker to write Out-of-Bounds, potentiaHigh 8.5 · May 14, 2026