Vulnerabilidades em AMD

467 resultados
Análise Vexday

O portfólio de vulnerabilidades da AMD reúne 443 CVEs catalogadas, com 59 registros surgidos nos últimos 90 dias, indicando um ritmo de descoberta que merece acompanhamento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero entradas no CISA KEV, o que sugere pressão operacional imediata menor em comparação com outros fornecedores. No entanto, a CVE mais perigosa atualmente monitorada, CVE-2023-20588, apresenta o maior EPSS observado no conjunto (0,1241), sinalizando probabilidade não negligenciável de exploração e justificando priorização nas rotinas de patch. A falha mais frequente, CWE-20 (validação inadequada de entrada), reflete uma fragilidade estrutural recorrente no código, enquanto as 6 CVEs de severidade crítica e a existência de pelo menos uma prova de conceito pública reforçam a necessidade de gestão ativa mesmo sem exploração confirmada no momento.

CVE-2023-31325HIGHImproper isolation of shared resources on System-on-a-chip (SOC) could a privileged attacker to tamper with the contents of the PSP reservedEPSS 0.1%CVE-2025-54519HIGHA DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary coEPSS 0.1%CVE-2025-0046HIGHIncorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.EPSS 0.1%CVE-2023-31322HIGHType confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted EPSS 0.1%CVE-2025-52538HIGHImproper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resultingEPSS 0.1%CVE-2021-46795MEDIUMA TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memoryEPSS 0.1%CVE-2024-36311MEDIUMA Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validEPSS 0.1%CVE-2023-31310MEDIUMImproper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set tEPSS 0.1%CVE-2023-20508MEDIUMImproper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled bEPSS 0.1%CVE-2026-0438MEDIUMA System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker couEPSS 0.1%CVE-2021-26350—A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in EPSS 0.1%CVE-2023-31308LOWA malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory reaEPSS 0.1%CVE-2025-61970HIGHWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary codEPSS 0.1%CVE-2025-48509LOWMissing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of EPSS 0.1%CVE-2025-0029LOWImproper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writeEPSS 0.1%CVE-2024-21981MEDIUMImproper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitrary code execution priEPSS 0.1%CVE-2025-52539HIGHA buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interfaceEPSS 0.1%CVE-2024-21947HIGHImproper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially reEPSS 0.1%CVE-2024-21970MEDIUMImproper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentiEPSS 0.1%CVE-2026-40652MEDIUMAn out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted TrueviEPSS 0.1%