CVE-2025-52540

Out‑Of‑Bounds Write in AMD PMF Driver Enables Local Privilege Escalation

View on CVE.org
Published May 15, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Description
An improper input validation vulnerability within the AMD Platform Management Framework (PMF) Driver can allow a local attacker to write Out-of-Bounds, potentially resulting in privilege escalation.

Analysis

AI-generated

Technical impact

The flaw is an improper input validation issue in the AMD Platform Management Framework (PMF) driver that allows an attacker with local access to perform an out‑of‑bounds write. This memory corruption can be leveraged to override control data or elevate privileges, thereby compromising system integrity. The weakness corresponds to CWE‑787 and enables the attacker to gain escalated rights on the affected machine.

Affected Systems

The vulnerability affects AMD Ryzen 6000 Series Processors with Radeon Graphics, AMD Ryzen 7035 Series Processors with Radeon Graphics, AMD Ryzen 7040 Series Mobile Processors with Radeon Graphics, AMD Ryzen 8040 Series Mobile Processors with Radeon Graphics, and AMD Ryzen Embedded 8000 Series Processors. Specific model revisions are not listed, and no version ranges are provided in the public data.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires local access, but the lack of additional constraints suggests a reasonably high likelihood of successful privilege escalation on vulnerable systems.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the fix contained in AMD Security Bulletin AMD‑SB‑4015 to update the PMF driver.
  • If the PMF driver is not required for the system’s operation, disable or remove it to eliminate the attack surface.
  • Maintain strict least‑privilege practices so that only trusted local accounts can access the kernel device interface for AMD PMF services.

Generated by OpenCVE AI on May 15, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Amd
Amd ryzen 6000 Series Processors With Radeon Graphics
Amd ryzen 7035 Series Processors With Radeon Graphics
Amd ryzen 7040 Series Mobile Processors With Radeon Graphics
Amd ryzen 8040 Series Mobile Processors With Radeon Graphics
Amd ryzen Embedded 8000 Series Processors
Vendors & Products Amd
Amd ryzen 6000 Series Processors With Radeon Graphics
Amd ryzen 7035 Series Processors With Radeon Graphics
Amd ryzen 7040 Series Mobile Processors With Radeon Graphics
Amd ryzen 8040 Series Mobile Processors With Radeon Graphics
Amd ryzen Embedded 8000 Series Processors
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Out‑Of‑Bounds Write in AMD PMF Driver Enables Local Privilege Escalation
Type Values Removed Values Added
Description An improper input validation vulnerability within the AMD Platform Management Framework (PMF) Driver can allow a local attacker to write Out-of-Bounds, potentially resulting in privilege escalation.
Weaknesses CWE-787
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
AMD
Published
Updated
May 16, 2026, 3:56 AM
Reserved
Jun 17, 2025, 4:53 PM

View source JSON

Updated
May 15, 2026, 1:30 PM

JSON

Status
Awaiting Analysis
Published
May 15, 2026, 2:16 AM
Modified
Jun 17, 2026, 9:36 AM

View source JSON

No data.

Updated
Jun 2, 2026, 8:56 PM

JSON