AMD Chipset Driver CVE-2026-0432

Exploitation requires authenticated local access to a Windows system with vulnerable AMD chipset driver installed - any user account including standard non-administrative users suffices (CVSS PR:L confirms low privilege requirement). Attack succeeds on default driver installations where installation directory permissions allow authenticated users to modify driver components. No user interaction required once attacker has local shell or RDP session. All AMD Ryzen, Threadripper, EPYC, and Athlon systems running affected chipset driver versions prior to 8.01.20.513 (consumer/workstation) or 8.03.14.329/8.03.16.641 (server) are vulnerable. Systems with hardened installation directory ACLs restricting write access to Administrators and SYSTEM only are NOT vulnerable. Single-user home systems face lower practical risk than multi-user enterprise workstations, terminal servers, or shared lab systems where multiple authenticated users operate on the same hardware.

Real-world risk is moderate-high for environments with untrusted authenticated users, but lower for single-user workstations. CVSS 8.5 (High) reflects maximum potential impact: complete system compromise from local authenticated position. However, exploitation prerequisites limit widespread attack scenarios - attacker needs existing authenticated Windows session, making this valuable primarily for lateral movement, persistence after initial access, or privilege escalation in multi-user environments. No EPSS score provided, no CISA KEV listing confirms no widespread exploitation observed. No public exploit identified at time of analysis, though the well-understood attack pattern (DLL hijacking or binary replacement in writable system directories) means weaponization is trivial once vulnerability details are public. SSVC factors favor patching: automatable once local access achieved, technical impact of total system control, but exploitation status remains proof-of-concept. Priority should be higher for: multi-user Windows systems, terminal servers, shared workstations, enterprise environments where standard users run on systems with AMD processors. Lower priority for: single-user home systems, physically secured workstations, environments with strong endpoint detection. The massive product scope (45+ processor families) means broad exposure across AMD-based Windows infrastructure.

Authenticated standard user on corporate Windows 10 workstation discovers writable AMD chipset driver directory. Attacker replaces legitimate driver DLL or service executable with malicious payload compiled to perform credential dumping and establish persistence. Upon next system reboot or driver reload, Windows loads malicious component with SYSTEM privileges, granting attacker full control to disable EDR, extract domain credentials from LSASS, and pivot to additional network resources.