Which versions of AMD GPIO Controller are affected by CVE-2025-48512?

CVE-2025-48512 is a privilege escalation vulnerability in AMD GPIO controller drivers affecting Ryzen and EPYC processors across desktop, mobile, and server platforms.

How to fix or mitigate CVE-2025-48512?

Within 24 hours: Identify all systems running affected AMD processors (Ryzen 3000-series through Ryzen AI 300 desktop/mobile; EPYC 9005 servers) and their current chipset driver versions. Within 7 days: Deploy patched AMD chipset drivers version 7.04.09.545 for desktop/mobile platforms and version 8.03.16.641 for server platforms; validate deployment across test systems before production rollout. Within 30 days: Complete enterprise-wide driver updates and confirm no systems remain on pre-patch versions through inventory audits.

AMD GPIO Controller CVE-2025-48512

Q: What is the CVSS score of CVE-2025-48512?

CVE-2025-48512 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209861 HIGH

Incorrect Default Permissions (CWE-276)

2026-05-15 AMD

GHSA-jgpx-6rhq-7873

Privilege Escalation Amd RCE

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 04:15 vuln.today

CVSS changed

May 15, 2026 - 02:22 NVD

7.0 (HIGH)

CVE Published

May 15, 2026 - 01:45 nvd

UNKNOWN (no severity yet)

CVE Published

May 15, 2026 - 01:45 nvd

HIGH 7.0

DescriptionCVE.org

Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attacker to achieve privilege escalation resulting in arbitrary code execution.

AnalysisAI

Privilege escalation in AMD GPIO controller driver for Windows allows authenticated local users with low privileges to execute arbitrary code with elevated rights via insecure directory permissions. Affects nearly the entire AMD processor portfolio from Ryzen 3000-series through latest EPYC 9005 and Ryzen AI 300. AMD has released patched chipset drivers (version 7.04.09.545 for most desktop/mobile products, 8.03.16.641 for server platforms) addressing the vulnerability. EPSS score and KEV status not provided in source data, but the local attack vector and user interaction requirement limit remote exploitation risk despite the 7.0 CVSS score.

Technical ContextAI

The vulnerability resides in AMD's GPIO (General-Purpose Input/Output) controller driver for Windows, classified as CWE-276 (Incorrect Default Permissions). GPIO controllers provide low-level hardware access for processor pin control and system management functions. The installation directory permissions issue allows users with limited privileges to modify or replace driver components. This affects AMD's chipset driver package across multiple processor architectures spanning seven years of product releases, from Zen 2 (Matisse/Picasso) through Zen 5 (Granite Ridge/Strix Point), including desktop Ryzen, mobile APUs, Threadripper workstation processors, and datacenter EPYC platforms. The CPE strings identify affected products as AMD Ryzen 3000-9000 series, Athlon 3000 series, Threadripper 3000-7000 series, and EPYC 7001-9005 series processors. The vulnerability exists in the Windows driver installation mechanism rather than processor silicon, indicating a software packaging/deployment flaw in AMD's chipset driver distribution.

RemediationAI

Install patched AMD chipset drivers immediately: version 7.04.09.545 for consumer desktop/mobile platforms (Ryzen 3000-9000, Threadripper, Athlon), version 8.03.16.641 for server platforms (EPYC 9004/9005, Instinct MI300A), version 8.03.14.329 for EPYC 7001-7003 series, or product-specific versions for embedded systems as detailed in AMD security bulletin AMD-SB-4015 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4015.html). Patched drivers are available through AMD Download Center or Windows Update depending on OEM configuration. For systems where immediate patching is not feasible, implement compensating controls: restrict physical and RDP access to trusted users only, enable Windows User Account Control at highest setting to force elevation prompts, monitor AMD GPIO driver directory (typically C:\Program Files\AMD or C:\AMD) for unauthorized file modifications using file integrity monitoring tools, and apply principle of least privilege by removing local administrator rights from standard user accounts. Note that disabling the GPIO driver may impact system stability or hardware monitoring functionality depending on motherboard implementation. Validate patch deployment by verifying driver version in Device Manager under System Devices or via PowerShell command Get-WmiObject Win32_PnPSignedDriver filtering for AMD GPIO. Organizations using AMD EPYC embedded systems should consult OEM vendors for firmware updates incorporating patched drivers, with some embedded platforms not receiving fixes until Q2-Q4 2025 per AMD's disclosure timeline.