The vulnerability exists due to unsafe OpenSSL initialization in certain AMD optional tools. A local user with elevated privileges can exploit this flaw to inject a malicious DLL, which can lead to arbitrary code execution. The weakness is a form of missing authorization for DLL loading, as identified by CWE‑427, allowing an attacker to execute arbitrary code under the application's context.

Affected components include AMD AIM‑T Manageability Service, AMD Cloud Manageability Service, AMD Manageability API, AMD Management Console, AMD Management Plug‑In for SCCM, and DASH CLI. No specific version details are provided in the data.

The CVSS score of 7 indicates medium‑to‑high severity. The lack of an EPSS score means current exploitation probability is unknown, and the vulnerability is not listed in CISA KEV. Because the flaw requires local privileged access, the attacker must already be in the system with elevated rights. Once the DLL is injected, the attacker achieves full code execution under the tool’s privileges, posing a significant threat to system compromise.