AMD Instinct MI210 vulnerabilities

19 CVEs affecting AMD Instinct MI210, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-43598, published 2026-10-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-43598, published 2026-10-06. High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days. Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer,…
CVE-2026-0481, published 2026-05-15. Critical severity, CVSS 9.2. EPSS: 0.3% chance of exploitation in the next 30 days. Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in…
CVE-2025-54511, published 2026-05-15. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a function without sufficient privileges and successfully write…
CVE-2022-23817, published 2024-08-13. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to read/write to the ASP Secure OS kernel virtual address…
CVE-2023-20516, published 2025-09-06. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. Improper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs) potentially resulting in loss of confidentiality or integrity.
CVE-2024-36342, published 2025-09-06. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution.
CVE-2021-26383, published 2025-09-06. High severity, CVSS 7.9. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient bounds checking in AMD TEE (Trusted Execution Environment) could allow an attacker with a compromised userspace to invoke a command with malformed arguments leading to out of bounds…
CVE-2023-31323, published 2026-02-12. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory Interconnect Trusted Agent (XGMI TA) leading to a memory safety…
CVE-2025-54517, published 2026-05-15. High severity, CVSS 8.5. EPSS: 0.1% chance of exploitation in the next 30 days. Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.
CVE-2023-31326, published 2025-09-06. Low severity, CVSS 2.8. EPSS: 0.1% chance of exploitation in the next 30 days. Use of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) driver, potentially leading to loss of confidentiality.

Latest

CVE-2025-52532, published 2026-05-15. Low severity, CVSS 2.0. EPSS: 0.1% chance of exploitation in the next 30 days. A race condition in the MxGPU-Virtualization driver’s ioctl path caused by concurrent unsynchronized access to the global variable amdgv_cmd in an unlocked ioctl handler could be exploited by an…
CVE-2026-0427, published 2026-05-15. Medium severity, CVSS 4.6. EPSS: 0.1% chance of exploitation in the next 30 days. Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared resources from another Guest VM,…
CVE-2025-66664, published 2026-05-15. Medium severity, CVSS 4.6. EPSS: 0.1% chance of exploitation in the next 30 days. Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_LOAD_GFX_IP_FW SR-IOV command to cause out-of-bounds read,…
CVE-2025-66660, published 2026-05-15. Low severity, CVSS 1.8. EPSS: 0.1% chance of exploitation in the next 30 days. Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to cause incorrect shared memory mapping, potentially resulting…
CVE-2023-31317, published 2026-05-15. High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days. Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or write to protected memory potentially resulting in…
CVE-2023-31316, published 2026-05-15. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could allow an attacker with the ability to write outside the…