This vulnerability arises from weak permissions set on the Vitis™ Unified installation path on Windows systems. A low-privileged user with local access could exploit this weakness to create or replace files with arbitrary code, potentially hijacking binaries executed by higher-privileged processes. The CVSS 4.0 vector indicates low attack complexity and privileges required, but user interaction is necessary. The vulnerability affects local installations of AMD Vitis™ Embedded Single File Download (SFD) for Windows. No vendor advisory or patch information is currently available.

If exploited, this vulnerability could allow a low-privileged user to execute arbitrary code by hijacking binaries in the installation path. This could lead to privilege escalation or unauthorized code execution on affected Windows machines. However, exploitation requires local access and user interaction, limiting remote exploitation scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for unauthorized changes in the installation directory. Avoid running untrusted code with elevated privileges in the affected environment.