A DLL hijacking flaw in the AMD Cleanup Utility permits a malicious actor to supply a rogue dynamic library that the Utility will load in place of a legitimate one. The attacker can then execute the injected code with the credentials of the Utility’s process, which typically runs with elevated system privileges, thereby achieving privilege escalation that may lead to arbitrary code execution on the affected machine. This weakness corresponds to the DLL hijacking concept and involves improper validation of DLL loading paths.

AMD products affected include the AMD Cleanup Utility as well as a wide range of Radeon GPUs across the VII, RX 5000/6000/7000, RX Vega, and PRO series cards. No specific version information is listed, so all installations that use the Utility at the time of the disclosure are considered potentially vulnerable.

The CVSS score for this issue is 7, indicating a high severity. EPSS score is 0.00011, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The attack vector is inferred to be local, relying on an attacker who can place a malicious DLL in a location that the Utility searches first; remote exploitation would require an additional vulnerability or compromised administrative access.