AMD Radeon Pro Vii vulnerabilities

9 CVEs affecting AMD Radeon Pro Vii, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-23826, published 2026-05-15.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-20601, published 2026-02-12. Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-of-service condition.
• CVE-2024-36342, published 2025-09-06. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution.
• CVE-2023-20514, published 2026-02-11. High severity, CVSS 8.7. EPSS: 0.2% chance of exploitation in the next 30 days. Improper handling of parameters in the AMD Secure Processor (ASP) could allow a privileged attacker to pass an arbitrary memory value to functions in the trusted execution environment resulting in…
• CVE-2023-31323, published 2026-02-12. High severity, CVSS 8.4. EPSS: 0.2% chance of exploitation in the next 30 days. Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory Interconnect Trusted Agent (XGMI TA) leading to a memory safety…
• CVE-2024-36320, published 2026-02-11. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. Integer Overflow within atihdwt6.sys can allow a local attacker to cause out of bound read/write potentially leading to loss of confidentiality, integrity and availability
• CVE-2024-36352, published 2025-09-06. High severity, CVSS 8.4. EPSS: 0.1% chance of exploitation in the next 30 days. Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary writes or denial of service.
• CVE-2024-21971, published 2025-02-12. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operating system crash, potentially leading…
• CVE-2021-26380, published 2026-05-15. Low severity, CVSS 1.8. EPSS: 0.1% chance of exploitation in the next 30 days. A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range resulting in loss of integrity.
• CVE-2022-23826, published 2026-05-15. Low severity, CVSS 1.8. EPSS: 0.1% chance of exploitation in the next 30 days. A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially leading to a loss of integrity.