AMD Uprof vulnerabilities

11 CVEs affecting AMD Uprof, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-28237, published 2026-06-09.

More from AMD.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-31348, published 2024-08-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
• CVE-2024-36340, published 2025-05-13. Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days. A junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting in arbitrary file deletion or disclosure.
• CVE-2023-31349, published 2024-08-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
• CVE-2023-31366, published 2024-08-13. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of service.
• CVE-2026-28237, published 2026-06-09. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of availability.
• CVE-2023-31341, published 2024-08-13. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attacker to cause an out-of-bounds write, potentially causing a Windows® OS crash,…
• CVE-2026-0466, published 2026-06-09. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potentially resulting in crash or denial of service.
• CVE-2025-48510, published 2025-11-24. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.
• CVE-2025-48511, published 2025-11-24. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in crash or denial of service.
• CVE-2025-29933, published 2025-11-24. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a crash or denial of service

Latest

• CVE-2025-48502, published 2025-11-21. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial of service.