EUVD-2025-210687
GHSA-5qgc-w3gc-w4mc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector confirmed by description; PR:L chosen because writing to DLL search paths requires at minimum a local user session, and C/I/A:L reflects bounded impact within the Vitis process with no evidence of broader scope change.
Primary rating from Vendor (amd).
CVSS VectorVendor: amd
Lifecycle Timeline
1DescriptionCVE.org
Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, potentially resulting in arbitrary code execution.
AnalysisAI
DLL injection via uncontrolled search paths in AMD Vitis™ Unified Installer on Windows allows a local attacker to plant a malicious DLL within the application's installation search paths, potentially achieving arbitrary code execution when a user launches Vitis components. All Windows installations prior to the confirmed patched release 2026.1 are affected, as documented in AMD security bulletin AMD-SB-8015. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the attack pattern aligns with well-understood Windows DLL search-order hijacking techniques commonly exploited in developer-toolchain targeting.
Technical ContextAI
AMD Vitis™ Unified Installer is the integrated development environment for FPGAs and Adaptive SoCs, deployed on Windows workstations. The vulnerability is rooted in an uncontrolled DLL search path - a Windows-specific weakness (functionally equivalent to CWE-427, Uncontrolled Search Path Element, though NVD lists CWE as N/A) where the application resolves DLL dependencies by traversing a sequence of directories without fully qualifying the DLL path. On Windows, if any directory that appears earlier in the search order is writable by a lower-privileged user, an attacker can pre-position a malicious DLL with the name of a legitimate Vitis dependency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) confirms a local attack vector with no special attack requirements and a user-triggered load condition, consistent with classic DLL search-order hijacking. The advisory tags this as a Microsoft-platform remote code execution class issue, and the vulnerability was reported by AMD's own PSIRT team.
RemediationAI
The primary fix is upgrading to Vitis™ Unified Installer version 2026.1, confirmed as the patched release by AMD security bulletin AMD-SB-8015 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8015.html) and corroborated by EUVD affected-version data. Until patching is complete, administrators should audit and harden permissions on the Vitis installation directory tree and all directories in the application's effective DLL search path, removing write access for non-administrative local user accounts - this directly eliminates the ability of a low-privileged local user to plant a malicious DLL. As an additional control, deploy application whitelisting (such as Windows Defender Application Control or AppLocker) to block execution of unsigned or unknown DLLs from within the Vitis installation paths; note that this requires policy tuning and may disrupt legitimate Vitis extensions or plugins. Avoid running Vitis components with full administrative privileges when not strictly required by the build process, as this bounds the impact if a DLL injection occurs.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today