143
CVEs
1
Critical
59
High
0
KEV
1
PoC
30
Unpatched C/H
55.9%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
59
MEDIUM
59
LOW
8
Monthly CVE Trend
Affected Products (30)
Linux Kernel
193
Debian Linux
40
Epyc 7443P Firmware
39
Epyc 7713 Firmware
39
Epyc 72F3 Firmware
39
Epyc 7443 Firmware
39
Epyc 74F3 Firmware
39
Epyc 7343 Firmware
39
Epyc 7763 Firmware
39
Epyc 7543 Firmware
39
Epyc 7643 Firmware
39
Epyc 7413 Firmware
39
Epyc 7543P Firmware
39
Epyc 75F3 Firmware
39
Epyc 7513 Firmware
39
Epyc 7713P Firmware
39
Epyc 7663 Firmware
39
Epyc 7313 Firmware
39
Epyc 7313P Firmware
39
Epyc 7453 Firmware
38
Epyc 73F3 Firmware
38
Epyc 7452 Firmware
32
Epyc 7272 Firmware
32
Epyc 7262 Firmware
32
Epyc 7542 Firmware
32
Epyc 7302P Firmware
32
Epyc 7352 Firmware
32
Epyc 7702 Firmware
32
Epyc 7532 Firmware
32
Epyc 7502P Firmware
32
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-0481 | Remote unauthenticated manipulation of AMD Instinct GPU configuration is possible in the AMD Device Metrics Exporter (DME), a ROCm-ecosystem monitoring component, because the service binds to an unrestricted IP address and exposes its control surface network-wide. Any attacker able to reach the listening port can push unauthorized GPU configuration changes, degrading or denying availability of the affected AMD Instinct MI-series accelerator (MI210/MI250/MI250X/MI300A/MI300X/MI308X/MI325X/MI350X/MI355X). No public exploit is identified at time of analysis, and EPSS is low (0.20%), but the CVSS 4.0 base score of 9.2 reflects trivial network reachability with high availability impact. | CRITICAL | 9.2 | 0.2% | 46 |
No patch
|
| CVE-2026-68329 | Use-after-free in the Linux kernel AMD IOMMU driver allows a local low-privileged attacker on multi-CPU AMD systems to corrupt kernel memory by exploiting a logical race in `iommu_completion_wait()`. The `need_sync` flag was read locklessly, enabling a CPU to return without waiting for hardware IOMMU command completion while another CPU's page-table pages are freed - leaving the IOMMU walking stale, potentially freed memory. No public exploit exists and EPSS is 0.20% (10th percentile), but successful exploitation on AMD virtualization infrastructure could cross IOMMU isolation boundaries affecting co-tenant VMs. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-53053 | Improper DMA-alias handling in the Linux kernel's AMD IOMMU driver lets a stale or incorrect Device Table Entry (DTE) be propagated to an alias PCI device, weakening the DMA isolation the IOMMU is meant to enforce. The flaw affects systems on AMD platforms where pci_for_each_dma_alias() supplies an alias-rather than the original-device to clone_alias(), causing the wrong source devid to be used when copying the DTE. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-46174 | Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users to trigger instruction corruption via improper isolation of shared resources in the op cache. Affecting kernels prior to 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.88, 6.18.30, and 7.0.7, the flaw carries a CVSS 8.8 due to scope change (S:C) impacting confidentiality, integrity, and availability beyond the original security boundary. EPSS is very low (0.02%, 7th percentile) and no public exploit identified at time of analysis, but the architectural nature of the bug (CPU op cache sharing) makes it relevant for multi-tenant and virtualization workloads. | HIGH | 8.8 | 0.0% | 44 |
PoC
|
| CVE-2025-62623 | Local privilege escalation in the ionic cloud driver used by VMware ESXi 8.x and 9.x hosts running AMD-Pensando DPU products allows a low-privileged local attacker to corrupt heap memory and potentially execute arbitrary code with elevated (host-level) privileges. The flaw was reported by AMD (AMD-SB-2001) and carries a CVSS 4.0 base score of 8.8 with a 'total' technical impact under SSVC. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2025-62624 | Privilege escalation in the ionic network driver on VMware ESXi 8.x and 9.x hosts equipped with AMD-Pensando DPU hardware allows a low-privileged local attacker to corrupt heap memory and potentially execute arbitrary code with elevated privileges. Reported by AMD (AMD-SB-2001) and tracked as EUVD-2025-209814, the flaw carries a CVSS 4.0 base score of 8.8 with total technical impact but high attack complexity. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with EPSS at just 0.01%, indicating no observed exploitation activity. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2023-31317 | Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or write to protected memory potentially resulting in. Rated high severity (CVSS 8.8). No vendor patch available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2024-36323 | Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized access to the register space of the JPEG cores assigned a. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2024-21962 | Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation and arbitrary code execution. Rated high severity (CVSS 8.6), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 8.6 | 0.0% | 43 |
No patch
|
| CVE-2026-43606 | Timing side-channel in AMD Vitis Libraries' ECDSA secp256k1 Security Module exposes private cryptographic keys to local attackers via statistical analysis of operation timing or electromagnetic emanations. Affected are versions prior to 2026.1 of the Vitis Libraries Security Module and Vitis Unified Installer for FPGAs and Adaptive SoCs on Windows. AMD has released version 2026.1 as the fix; no public exploit or active exploitation has been identified at time of analysis. | HIGH | 8.5 | 0.1% | 43 |
No patch
|
| CVE-2025-54517 | Buffer overflow in AMD GPU driver IOCTL handler enables local privilege escalation to root on Linux systems running AMD Instinct or Radeon Pro GPUs. Authenticated local users with low privileges can exploit an out-of-bounds write vulnerability in the AMDGV_CMD_GET_DIAG_DATA IOCTL to achieve arbitrary kernel code execution. EPSS data not available; no public exploit or CISA KEV listing identified at time of analysis, suggesting limited active exploitation despite high CVSS 8.5 severity. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2025-48519 | Out-of-bounds read/write in AMD Platform Management Framework (PMF) driver allows local authenticated users to escalate privileges on Ryzen 6000/7000/8000 series processors. AMD has released patched chipset software version 7.06.02.123 addressing the improper input validation vulnerability. No public exploit code identified and CISA has not added this to KEV, indicating exploitation is not yet confirmed in real-world attacks despite the high CVSS score. Attackers must already have local system access with standard user privileges to exploit this vulnerability. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2025-52540 | Out-of-bounds write in the AMD Platform Management Framework (PMF) Driver enables local authenticated users to escalate privileges on AMD Ryzen 6000/7000/8000 series processors. The vulnerability stems from improper input validation (CWE-787) allowing memory corruption beyond allocated buffer boundaries. Exploitation requires low-privilege local access with low attack complexity (CVSS 4.0: AV:L/AC:L/PR:L), making this a realistic post-compromise escalation vector. AMD released chipset driver version 7.06.02.123 addressing all affected Ryzen series. No public exploit or active exploitation confirmed at time of analysis. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2025-61972 | Privilege escalation into the AMD Secure Processor affects AMD EPYC 8004/9004/9005 and EPYC Embedded 8004/9004/9005 series processors, where missing lock bit protection on NBIO registers lets a local admin-privileged attacker gain arbitrary System Management Network (SMN) access. This can lead to arbitrary code execution inside the AMD Secure Processor (ASP) and breaks the confidentiality and integrity guarantees SEV-SNP is supposed to provide to confidential-computing guests. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.01%), and CISA SSVC rates exploitation as none but technical impact as total. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2026-0432 | Insecure installation directory permissions in AMD chipset driver allow local authenticated attackers to achieve SYSTEM-level privilege escalation and execute arbitrary code. The vulnerability affects nearly all AMD Ryzen, Threadripper, EPYC, and Athlon processors across desktop, mobile, embedded, and server product lines. AMD has released patched chipset driver versions 8.01.20.513 (consumer/workstation) and 8.03.14.329/8.03.16.641 (server). No active exploitation confirmed at time of analysis, but the local vector and low attack complexity make this exploitable by any authenticated Windows user, including standard users without admin rights. | HIGH | 8.5 | 0.0% | 43 |
No patch
|