Vulnerability in AMD Radeon Pro Software
CVE-2020-12891
AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location which is in path environment variable.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (15.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- AMD Radeon Pro Software
- AMD Radeon Pro Software For Enterprise — versions Enterprise Driver
- AMD Radeon Software — versions Radeon Driver
- AMD Radeon Software
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.amd.com/en/corporate/product-security/bulletin/amd-sb-1000 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-12891?
- CVE-2020-12891 is a high-severity vulnerability in AMD Radeon Pro Software, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2022-02-04.
- How severe is CVE-2020-12891?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2020-12891 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.