Which versions of AMD Ryzen Master are affected by CVE-2025-54512?

AMD Ryzen Master contains a privilege-escalation vulnerability (CVE-2025-54512, CVSS 7.0) that allows local low-privileged users to execute arbitrary code with system privileges through DLL hijacking…

How to fix or mitigate CVE-2025-54512?

Within 24 hours, inventory all Windows systems running AMD Ryzen Master versions 3.0.0.4199 or earlier (including SDK versions up to 3.0.1.4732 and legacy branch up to 2.14.3.5040) and categorize by operational criticality. Within 7 days, uninstall the vulnerable software from non-critical systems, implement access controls to restrict local user privilege escalation on systems where Ryzen Master cannot be removed, and enable application whitelisting where available. Within 30 days, evaluate AMD's patched versions (when released), document and test any alternative solutions, and establish a process for validating safe installation practices for future Ryzen Master deployments.

AMD Ryzen Master CVE-2025-54512

Q: What is the CVSS score of CVE-2025-54512?

CVE-2025-54512 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-210697 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-08-11 psirt@amd.com

GHSA-9h6x-cxhq-cjmc

Amd RCE

7.0

CVSS 4.0 · Vendor: amd

Severity by source

Vendor (amd) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Local vector confirmed; low privilege and user interaction (installation trigger) required per description and CVSS 4.0; no scope change; full local C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (amd).

CVSS VectorVendor: amd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:49 vuln.today

CVE Published

Aug 11, 2026 - 18:17 cve.org

HIGH 7.0

DescriptionCVE.org

A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary code execution.

AnalysisAI

DLL hijacking during the AMD Ryzen Master installation process allows a local low-privileged attacker to escalate privileges and execute arbitrary code on Windows systems running affected versions. The flaw, rooted in an uncontrolled DLL search path (CWE-427), affects AMD Ryzen Master up to 3.0.0.4199, Ryzen Master SDK up to 3.0.1.4732, and a legacy branch for Ryzen 3000 Series processors up to 2.14.3.5040. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-427 (Uncontrolled Search Path Element) is the root cause: the AMD Ryzen Master installer or an associated privileged process resolves DLL dependencies by searching directories in a predictable order, at least one of which is writable by low-privileged users. By pre-staging a malicious DLL with the expected filename in such a directory, an attacker causes the privileged process to load and execute attacker-controlled code instead of the legitimate library. AMD Ryzen Master is a Windows-only utility providing CPU overclocking, voltage tuning, and performance monitoring for AMD Ryzen processors. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:P confirms the attack surface is local, complexity is low once in position, no special attack prerequisites are required beyond standard user credentials, and a passive user interaction event - such as triggering or waiting for an installation - is necessary.

RemediationAI

Update AMD Ryzen Master to the patched releases specified in AMD Security Bulletin AMD-SB-9020 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9020.html): Ryzen Master to version 3.0.0.4199, Ryzen Master SDK to version 3.0.1.4732, and the Ryzen 3000 Series legacy variant to version 2.14.3.5040. Where immediate patching is not possible, restrict write permissions on user-writable directories present in the DLL search path - particularly the application installation directory and any directories listed in the system or user PATH environment variable - so that standard user accounts cannot pre-stage files there; note this may break other applications that legitimately depend on user-writable path entries. Additionally, configure endpoint security tooling to alert on unsigned or unexpected DLLs loaded by AMD Ryzen Master processes during installation events, and avoid running Ryzen Master installations on systems with untrusted local users or known malware presence.