Vitis Unified EUVD-2025-210686

AMD Vitis Unified is a software development platform targeting FPGA, embedded processor, and adaptive compute workloads, primarily used by hardware engineers on Windows workstations. The vulnerability class is binary (DLL or executable) hijacking: Windows resolves library and executable paths by searching a sequence of directories, and if any directory in that sequence is writable by a low-privileged account, an attacker can plant a malicious file that a higher-privileged process loads instead of the legitimate one. The root cause is misconfigured Access Control Lists (ACLs) on the Vitis installation directory, allowing write access to accounts that should only have read/execute permissions. Although CWE is listed as N/A in the source data, this pattern is most closely associated with CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-426 (Untrusted Search Path). The CVSS 4.0 vector confirms local attack surface (AV:L), attack preconditions (AT:P), low privilege required (PR:L), and active user interaction (UI:A), consistent with a hijacking scenario requiring a privileged user to invoke the affected binary.