AMD Radeon Pro v520 vulnerabilities
13 CVEs affecting AMD Radeon Pro v520, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-46747, published 2026-06-01.
More from AMD.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2025-54511, published 2026-05-15. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a function without sufficient privileges and successfully write…
- CVE-2024-36324, published 2026-02-11. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary code execution.
- CVE-2024-36316, published 2026-02-11. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a denial of service
- CVE-2021-26381, published 2026-02-10. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a large number of pages, potentially resulting in kernel memory…
- CVE-2021-26410, published 2026-02-10. Low severity, CVSS 1.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing an attacker to infer the contents of the…
- CVE-2024-36353, published 2025-03-02. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentially leading to loss of confidentiality.
- CVE-2023-20508, published 2025-02-12. Medium severity, CVSS 5.0. EPSS: 0.1% chance of exploitation in the next 30 days. Improper access control in the ASP could allow a privileged attacker to perform an out-of-bounds write to a memory location not controlled by the attacker, potentially leading to loss of…
- CVE-2024-21971, published 2025-02-12. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operating system crash, potentially leading…
- CVE-2023-31309, published 2026-05-15. Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days. Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting table data from SMU to DRAM potentially resulting in…
- CVE-2025-66664, published 2026-05-15. Medium severity, CVSS 4.6. EPSS: 0.1% chance of exploitation in the next 30 days. Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_LOAD_GFX_IP_FW SR-IOV command to cause out-of-bounds read,…
Latest
- CVE-2021-46747, published 2026-06-01. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN (System Management Network) apertures…
- CVE-2022-23826, published 2026-05-15. Low severity, CVSS 1.8. EPSS: 0.1% chance of exploitation in the next 30 days. A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially leading to a loss of integrity.
- CVE-2021-26380, published 2026-05-15. Low severity, CVSS 1.8. EPSS: 0.1% chance of exploitation in the next 30 days. A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range resulting in loss of integrity.