EUVD-2026-66455
GHSA-6g4g-qg49-hpx9
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access and low privileges are required to submit UVD decode commands; the resulting kernel heap corruption enables full privilege escalation, justifying high C/I/A with no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix UVD decode image min size calculation
This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow.
(cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)
AnalysisAI
Integer overflow in the amdgpu DRM subsystem's UVD (Unified Video Decoder) component exposes systems running AMD GPUs to local privilege escalation. The minimum image size calculation incorrectly references the image width rather than the pitch value, and fails to reject pitch values exceeding 4096, allowing arithmetic overflow that produces an artificially small size bound. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target system must be running a vulnerable Linux kernel version with the amdgpu driver loaded and bound to AMD GPU hardware that exposes UVD (Unified Video Decoder) functionality - not all AMD GPU generations include UVD. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the threat model: this is a local privilege escalation requiring only a shell account on a system with an AMD GPU. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged user on a Linux system with an AMD GPU opens a UVD decode session and submits a crafted image descriptor specifying a pitch value above 4096. The kernel's minimum size validation overflows, accepting a buffer far smaller than required. … |
| Remediation | Upgrade the Linux kernel to one of the vendor-released patched stable versions: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, or mainline 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running AMD GPU hardware and verify current amdgpu DRM driver versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today