EUVD-2025-210695
GHSA-2g83-4fww-rc5m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low privileges; user-initiated uninstall required (UI:R); no scope change as downstream system impacts are absent per the provided 4.0 vector.
Primary rating from Vendor (amd).
CVSS VectorVendor: amd
Lifecycle Timeline
2DescriptionCVE.org
A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution.
AnalysisAI
DLL hijacking in AMD Power Design Manager (PDM) enables a local, low-privileged attacker to escalate privileges during the software's uninstallation process, ultimately achieving arbitrary code execution at a higher privilege level. The vulnerability stems from CWE-427 (Uncontrolled Search Path Element), where the PDM uninstaller resolves DLL dependencies from directories writable by unprivileged users. AMD PSIRT confirmed the issue and released an Un-Installer patch at version 2026.1 via Security Bulletin AMD-SB-8016; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-427 (Uncontrolled Search Path Element) describes a class of vulnerability where an application resolves the location of a required library by searching an ordered list of directories, some of which may be attacker-controlled. During the AMD Power Design Manager uninstallation process, the uninstaller executable - which runs with elevated privileges - searches for one or more DLLs in a path that a low-privileged local user can write to. By pre-positioning a malicious DLL with the expected filename in that search path, the attacker causes the elevated uninstaller process to load and execute attacker-supplied code. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P) corroborates this: the attack is local, requires no special system configuration beyond write access to the DLL search directory, and demands only passive user interaction - the uninstallation must be triggered by any user or administrator. No CPE strings were supplied in the input data; the affected component is specifically identified as the AMD PDM Un-Installer.
RemediationAI
Apply the AMD Power Design Manager Un-Installer patch version 2026.1 as documented in AMD Security Bulletin AMD-SB-8016 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8016.html). This is the vendor-confirmed fix and should be the primary remediation action. If immediate patching is not feasible, restrict write permissions on directories included in the DLL search path used by the PDM uninstaller - specifically, ensure low-privileged users cannot place files in folders where the uninstaller resolves its DLL dependencies. This compensating control requires identifying the exact search paths used by the uninstaller (via tools such as Process Monitor) and hardening their ACLs, which may require operational effort and could affect other software sharing those paths. Additionally, limit uninstallation operations to trusted administrators only and monitor for unexpected DLL loads during PDM uninstall events using endpoint detection tooling.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today