EUVD-2025-210694
GHSA-594x-q5wg-qmjc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack, low-privileged account required to plant payload, active user interaction needed to trigger; limited CIA impact per vendor 4.0 vector.
Primary rating from Vendor (amd).
CVSS VectorVendor: amd
Lifecycle Timeline
1DescriptionCVE.org
Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.
AnalysisAI
Uncontrolled search path in AMD's Vitis Embedded Single File Download (SFD) installer for Windows enables local privilege escalation to arbitrary code execution. The vulnerability affects local Windows installations and requires a low-privileged user to plant a malicious binary or DLL in a directory included in the application's search path. No public exploit code or active exploitation has been identified at time of analysis; AMD has released a fix in patch version 2026.1 per AMD Security Bulletin AMD-SB-8015.
Technical ContextAI
Uncontrolled search path vulnerabilities (commonly CWE-427 - though NVD has not assigned a CWE for this entry) occur when an application resolves executable or library dependencies by searching user-writable directories before trusted system directories. On Windows, this commonly manifests as DLL hijacking or binary planting: if the application's working directory, a user-writable PATH entry, or a relative import path is searched before %SYSTEM32%, an unprivileged user can preload a malicious module. The affected component is AMD's Vitis Embedded SFD, a Windows installation utility associated with the Vitis embedded development toolchain - a successor to Xilinx tools used for FPGA and embedded SoC development. The fix is scoped to the Windows variant; no CPE string was provided by NVD, but the EUVD identifies the affected software as 'Vitis Embedded Single File Download (SFD) for Windows' with patch version 2026.1.
RemediationAI
Vendor-released patch: 2026.1 - upgrade to Vitis Embedded SFD for Windows patch version 2026.1 as documented in AMD Security Bulletin AMD-SB-8015 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8015.html). As a compensating control where immediate patching is not feasible, restrict write access to directories included in the PATH and application working directories used by the Vitis SFD installer; this limits the ability of low-privileged users to plant malicious binaries. Additionally, avoid running the Vitis SFD installer on shared multi-user Windows systems where untrusted low-privileged accounts are present. Running the installer from a dedicated, access-controlled developer workstation with strict local account separation reduces the realistic attack surface. Note that restricting PATH write access may interfere with other developer toolchain components that require user-writable paths.
Same weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today