Vulnerabilidades em AMD

467 resultados
Análise Vexday

O portfólio de vulnerabilidades da AMD reúne 443 CVEs catalogadas, com 59 registros surgidos nos últimos 90 dias, indicando um ritmo de descoberta que merece acompanhamento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero entradas no CISA KEV, o que sugere pressão operacional imediata menor em comparação com outros fornecedores. No entanto, a CVE mais perigosa atualmente monitorada, CVE-2023-20588, apresenta o maior EPSS observado no conjunto (0,1241), sinalizando probabilidade não negligenciável de exploração e justificando priorização nas rotinas de patch. A falha mais frequente, CWE-20 (validação inadequada de entrada), reflete uma fragilidade estrutural recorrente no código, enquanto as 6 CVEs de severidade crítica e a existência de pelo menos uma prova de conceito pública reforçam a necessidade de gestão ativa mesmo sem exploração confirmada no momento.

CVE-2024-36342HIGHImproper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execuEPSS 0.2%CVE-2024-36355HIGHImproper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (sEPSS 0.2%CVE-2023-20582MEDIUMImproper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults EPSS 0.2%CVE-2024-36316MEDIUMThe integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a deniaEPSS 0.2%CVE-2025-62626HIGHImproper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruEPSS 0.2%CVE-2025-29948MEDIUMImproper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass RMP protections, EPSS 0.2%CVE-2025-62625MEDIUMImproper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentiaEPSS 0.2%CVE-2025-52541HIGHA DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary codEPSS 0.2%CVE-2025-29952MEDIUMImproper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP EPSS 0.2%CVE-2024-36340MEDIUMA junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting EPSS 0.2%CVE-2023-31358HIGHA DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting inEPSS 0.2%CVE-2024-36354HIGHImproper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sysEPSS 0.2%CVE-2025-48508MEDIUMImproper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control EPSS 0.2%CVE-2026-100493MEDIUMAn integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an uEPSS 0.2%CVE-2023-20581LOWImproper access control in the IOMMU may allow a privileged attacker to bypass RMP checks, potentially leading to a loss of guest memory intEPSS 0.2%CVE-2023-20579LOWImproper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections EPSS 0.2%CVE-2021-26315—When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficientEPSS 0.2%CVE-2023-20515MEDIUMImproper access control in the fTPM driver in the trusted OS could allow a privileged attacker to corrupt system memory, potentially leadingEPSS 0.2%CVE-2025-52536MEDIUMImproper Prevention of Lock Bit Modification in SEV firmware could allow a privileged attacker to downgrade firmware potentially resulting iEPSS 0.2%CVE-2023-31359HIGHIncorrect default permissions in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting inEPSS 0.2%