The Radeon RGB tool fails to properly verify the cryptographic signature of files it processes. A malicious file placed in the tool’s installation directory can thus be executed with the tool’s elevated privilege level, allowing an attacker to run arbitrary code on the host with potentially full system privileges. This flaw aligns with CWE-347 and provides a direct avenue for privilege escalation and compromise of confidentiality, integrity, and availability.

AMD Radeon RX 7000 Series Graphics Products

The CVSS score of 7 indicates a medium to high severity. EPSS is not available so the current exploitation probability is unclear, but the flaw is not in the CISA KEV catalog, which suggests it has not yet been widely exploited. Attackers would need local access to place a malicious file in the installation directory. Hence the vulnerability is easier to exploit in environments where the Radeon RGB tool directory has write permissions for non‑privileged users or is not protected. Because the attack requires local file placement, the risk is significant only in scenarios where attackers can influence the installation path or obtain sufficient privileges to write to the directory.