The vulnerability is an out-of-bounds read in the AMD Compressonator SDK when processing specially crafted Truevision Advanced Raster Graphics Adapter (TGA) files. This flaw can lead to an attacker with local access reading sensitive heap memory contents or triggering a crash that results in denial of service. The weakness is identified as CWE‑125, which indicates an attempt to read data outside the bounds of a buffer, compromising confidentiality and availability.

The affected product is AMD Compressionator SDK. Specific vendor: AMD. No version details are listed in the advisory, so affected releases remain unknown; users should check the SDK version they run and consult AMD releases for a fix.

The CVSS score of 5.2 indicates a moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently widely exploited. The attack requires local access to supply a crafted TGA file, likely through a user or automated pipeline. Exploitability is limited to environments where TGA processing is enabled; a local adversary could read heap data or crash the application, but remote exploitation is unlikely.