This vulnerability arises from uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) installer on Windows systems. Such a flaw can enable a low-privileged user to influence the loading of executable code during installation, potentially leading to arbitrary code execution. The CVSS 4.0 vector indicates local attack vector with low complexity and no privileges required, but user interaction is needed. Confidentiality, integrity, availability, and security requirements are all impacted at low levels. AMD has published the vulnerability but has not provided a remediation level or patch information.

A low-privileged user on a local Windows system could exploit this vulnerability to execute arbitrary code, potentially compromising system integrity and security. The impact is considered high severity due to the possibility of code execution, but exploitation requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by AMD, users should monitor AMD's advisories for updates. Until a patch is available, restrict local user permissions and avoid running the installer in untrusted environments.