Threat database

CVE-2026-43598 is a high-severity vulnerability in the AMD ROCm Communication Collectives Library (RCCL) used by AMD Instinct™ MI210. It involves improper input validation that could allow a compromised peer or network-adjacent attacker to dereference an attacker-controlled pointer, potentially leading to remote code execution.

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.

In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability.

CVE-2026-81485 is a path traversal vulnerability in danielpopamd linkedin-ads-mcp version 1.0.0. The flaw exists in the fs.readFileSync function within the src/tools/campaign-management.ts file, specifically in the Media Upload component. This vulnerability allows an attacker to manipulate the filePath argument to access unauthorized files. The vulnerability can be exploited remotely. The issue was reported early to the project but no response or fix has been provided yet. Public exploit details have been disclosed.

A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary code execution.

A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potentially resulting in loss of availability

Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.

A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution.

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution.

Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution.

Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary code, potentially resulting in binary hijacking.

Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.

Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially perform timing analysis or electromagnetic emanation attacks, resulting in high confidentiality and integrity impact due to the exposure of private cryptographic keys.

The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary code execution.

Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to potentially overwrite guest memory resulting in loss of guest data integrity.

Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of availability.

Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potentially resulting in crash or denial of service.

Improper access control for register interface in the Input-Output Memory Management Unit (IOMMU) could allow a privileged attacker to cause non-coherent accesses by the AMD Secure Processor (ASP), potentially resulting in loss of integrity.

Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write to a limited section of the Top of Memory Segment (TSEG) memory region, potentially resulting in loss of confidentiality or integrity.

CVE-2025-54518 is a vulnerability in AMD EPYC 7002 Series Processors based on the Zen 2 architecture. It involves improper isolation of shared CPU operation cache resources, which could allow an attacker with limited privileges to corrupt instructions executed at a higher privilege level, potentially leading to privilege escalation. The vulnerability has a CVSS 4.0 score of 7.3, indicating high severity. There are no known exploits in the wild. The vendor advisory from Red Hat references this CVE but does not indicate an available fix specifically for this issue in their OpenShift Container Platform 4.12.97 update. Users are advised to monitor vendor channels for updates. No affected versions are explicitly stated in the provided data.