Which versions of AMD Power Design Manager are affected by CVE-2025-0046?

AMD Power Design Manager (PDM) Software Installer contains a local privilege escalation vulnerability (CVE-2025-0046) that allows low-privileged Windows users to execute arbitrary code with…

How to fix or mitigate CVE-2025-0046?

Within 24 hours, inventory all systems running AMD PDM and assess which machines have local user access that could be exploited. Within 7 days, validate and deploy patched version 2026.1 to pilot environments to confirm compatibility, then schedule production rollout in maintenance windows. Within 30 days, complete deployment of version 2026.1 across all affected systems, verify installation through software inventory tools, and document remediation status for compliance reporting.

AMD Power Design Manager CVE-2025-0046

Q: What is the CVSS score of CVE-2025-0046?

CVE-2025-0046 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-210696 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-08-11 psirt@amd.com

GHSA-g5cg-h7gg-4fc6

RCE

7.0

CVSS 4.0 · Vendor: amd

Severity by source

Vendor (amd) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Local attack requiring a low-privileged account and passive privileged-user interaction, with no scope change and full CIA impact on the vulnerable system.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (amd).

CVSS VectorVendor: amd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:49 vuln.today

CVE Published

Aug 11, 2026 - 18:17 cve.org

HIGH 7.0

DescriptionCVE.org

Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.

AnalysisAI

Local privilege escalation in AMD Power Design Manager (PDM) Software Installer for Windows enables a low-privileged local user to exploit incorrectly configured directory permissions, potentially resulting in arbitrary code execution at an elevated privilege level. The vulnerability is confirmed by AMD PSIRT via security bulletin AMD-SB-8016, and a patched version (2026.1) has been released. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

The root cause is incorrect directory permissions assigned by or during the AMD Power Design Manager (PDM) Software Installer for Windows - a condition functionally equivalent to CWE-732 (Incorrect Permission Assignment for Critical Resource) or CWE-276 (Incorrect Default Permissions), though the CWE field is listed as N/A in available data. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) confirms the attack is local, requires only low privilege to initiate, imposes no special attack conditions, and yields full compromise of confidentiality, integrity, and availability on the vulnerable system without scope change to subsequent systems. AMD PDM is a Windows-hosted engineering tool used by hardware and power-system designers working with AMD components. No CPE strings were provided in the available intelligence.

RemediationAI

The primary fix is to upgrade AMD Power Design Manager (PDM) Software Installer for Windows to patch version 2026.1, as documented in AMD Security Bulletin AMD-SB-8016 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8016.html). If immediate patching is not feasible, compensating controls should include restricting local logon access to AMD PDM systems to only those users who require it, applying the principle of least privilege to service accounts that interact with PDM-managed directories, and auditing directory ACLs on PDM installation paths to identify and correct overly permissive entries. Removing unnecessary local user accounts reduces the attacker pool. These workarounds reduce exposure but do not eliminate the underlying permission flaw and should be treated as temporary measures only.