AMD Radeon Rx Vega 56 Firmware vulnerabilities

8 CVEs affecting AMD Radeon Rx Vega 56 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-31320, published 2023-11-14.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-31320, published 2023-11-14. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in denial of service.
• CVE-2021-26392, published 2022-11-09. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading…
• CVE-2020-12930, published 2022-11-09. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity.
• CVE-2021-26393, published 2022-11-09. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with privileges to generate a valid signed TA and potentially…
• CVE-2021-46748, published 2023-11-14. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient bounds checking in the ASP (AMD Secure Processor) may allow an attacker to access memory outside the bounds of what is permissible to a TA (Trusted Application) resulting in a potential…
• CVE-2021-26391, published 2022-11-09. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the OS/kernel.
• CVE-2023-20568, published 2023-11-14. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch RadeonInstaller.exe without validating the file signature…
• CVE-2023-20567, published 2023-11-14. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch AMDSoftwareInstaller.exe without validating the file signature…