This vulnerability (CVE-2026-0428) affects the AMD Instinct™ MI300A platform and involves improper validation of a specified quantity in input parameters within the TEE SOC Driver. An attacker with high privileges can issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REG command to write invalid data to a remote Die. This improper input sanitization could lead to unexpected device behavior. The CVSS 4.0 vector indicates local attack vector, high attack complexity, no user interaction required, and low impact on availability. No patch or remediation level has been provided by AMD as of the publication date.

The impact is limited due to the low CVSS score (1.8) and the requirement for high privileges to exploit the vulnerability. Successful exploitation could cause unexpected behavior on the affected hardware by writing invalid data to a remote Die, but there is no indication of privilege escalation, denial of service, or data confidentiality/integrity compromise. No known exploits exist in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been provided by AMD, users should monitor AMD's advisories for updates. Given the requirement for high privileges to exploit this vulnerability, limiting administrative access and following best practices for privileged account management may reduce risk until a patch is available.