Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker… (CVE-2026-43598)

CVE-2026-43598 describes an improper input validation vulnerability in AMD's ROCm Communication Collectives Library (RCCL). This vulnerability allows a compromised peer rank or a network-adjacent attacker to dereference a pointer controlled by the attacker, which may lead to remote code execution. The vulnerability is rated medium severity per the CVSS 4.0 vector provided. The affected versions are explicitly enumerated, including multiple Ubuntu package versions and RCCL releases. No vendor advisory or patch information is available in the provided data, and no known exploits have been reported.

Successful exploitation could allow an attacker with limited privileges or a compromised peer in the network to execute arbitrary code remotely by leveraging the improper input validation flaw. This could compromise the integrity and confidentiality of systems running the affected RCCL versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to trusted peers and monitor for suspicious activity related to RCCL communications. Avoid exposing RCCL services to untrusted networks.