VulnerabilityPublished 29 Oct 2026

Amd uProof kernel driver vuln EoP

Source Reddit ExploitDev

Severity

Medium

Rated by Threat Radar

Data as of 31 Oct 2026, 18:36 UTC

What to do

AI-suggested

Users should verify with AMD for any updates or advisories. On Windows 11, enabling Memory Integrity (VBS/HVCI) mitigates the exploit by preventing writes to IA32_LSTAR. Until a vendor fix is available, restricting access to the AMD uProf driver and avoiding loading unsigned or untrusted drivers can reduce risk.

Discussion

A vulnerability in the AMD uProf kernel driver (AmdTools64.sys) version 5.3.521.0 allows local users with a handle to the driver to read and write Model-Specific Registers (MSRs) without proper validation. This enables an elevation of privilege (EoP) by overwriting the IA32_LSTAR MSR, which controls the CPU's syscall entry point, allowing execution of arbitrary code at kernel privilege level (CPL0). The exploit bypasses Kernel Address Space Layout Randomization (KASLR) and SMEP protections to escalate privileges to SYSTEM on Windows 10 x64 22H2. On Windows 11 with Memory Integrity enabled, the write is blocked. The vulnerability requires administrative rights to load the driver but then allows ring-0 code execution. AMD was notified but did not acknowledge the issue as of the report date.

r/ExploitDev (opens in a new tab)u/nanaynunay0 points0 comments

poc is public, support pls
https://github.com/mein-0/MercilessAmd

Links cited in the discussion

https://github.com/mein-0/MercilessAmd

Impact

Local users with access to the AMD uProf driver can escalate privileges to SYSTEM by exploiting the ability to overwrite the IA32_LSTAR MSR, enabling arbitrary kernel code execution. This breaks kernel security mechanisms such as KASLR and SMEP, allowing full control over the system at the highest privilege level. The exploit requires administrative rights to load the driver but then allows persistent ring-0 code execution. On Windows 11 with Memory Integrity enabled, the exploit is mitigated by blocking the MSR write.

Summary

The AMD uProf kernel driver (AmdTools64.sys) version 5.3.521.0 exposes two IOCTLs that allow reading and writing of MSRs with no index validation, only buffer length checks. This permits a local user with access to the driver to read the IA32_LSTAR MSR, revealing the kernel syscall handler address and breaking KASLR. More critically, the user can overwrite IA32_LSTAR to redirect syscalls to attacker-controlled code running at kernel privilege. The exploit chain includes disabling SMEP via kernel gadgets to execute shellcode that copies the SYSTEM token to the current process, achieving privilege escalation. The vulnerability was tested successfully on Windows 10 x64 22H2. On Windows 11 with Memory Integrity (VBS/HVCI), the write is blocked. The driver is signed and shipped with AMD uProf, commonly installed on AMD machines. The researcher reported the issue to AMD PSIRT on 2026-08-17, but AMD did not acknowledge the vulnerability.

References

Community reviews

Loading reviews…