Description
Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution.
Published: 2026-08-11
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from improper file permissions in the Vitis Unified installation directory on Windows. A user with standard local privileges can replace or modify files in this path, enabling execution of arbitrary code with elevated rights. The weakness is classified as CWE‑276, indicating inappropriate access control on privileged files.

Affected Systems

The affected component is the AMD Vitis Unified Installer for FPGAs & Adaptive SoCs on Windows. No specific version numbers are provided in the available data.

Risk and Exploitability

The CVSS score of 7.3 marks the issue as high severity. The EPSS score of less than 1 % suggests that exploitation is currently unlikely. It is not listed in the CISA KEV catalog. Attackers would need local access to the Windows machine and the ability to write to the Vitis installation path; the attack vector is inferred to be local file‑system manipulation.

Generated by OpenCVE AI on August 13, 2026 at 02:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available patch or newer version of the AMD Vitis Unified Installer.
  • Restrict the permissions on the Vitis installation directory so that only administrative accounts can write to it.
  • Monitor the installation directory for unauthorized changes and enforce least‑privilege access control.
  • If a patch is not yet available, consider moving the installation to a location with stricter permissions or removing write access for standard users.

Generated by OpenCVE AI on August 13, 2026 at 02:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Amd
Amd vitis Unified Installer
Vendors & Products Amd
Amd vitis Unified Installer

Thu, 13 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Weak Permissions in AMD Vitis Unified Installer Allow Privilege Escalation

Wed, 12 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Weak Permissions in AMD Vitis Unified Installer Allow Privilege Escalation

Wed, 12 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-276

Tue, 11 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Description Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged escalation, potentially resulting in arbitrary code execution.
References
Metrics cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N'}

Subscriptions

Amd Vitis Unified Installer
cve-icon MITRE

Status: PUBLISHED

Assigner: AMD

Published:

Updated: 2026-08-12T12:59:15.121Z

Reserved: 2025-05-22T16:34:02.896Z

Link: CVE-2025-48505

cve-icon Vulnrichment

Updated: 2026-08-11T19:42:09.902Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-11T17:17:44.067

Modified: 2026-08-12T20:50:58.370

Link: CVE-2025-48505

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:54:06Z

Weaknesses
  • CWE-276

    Incorrect Default Permissions