Improper Access Control in AMD uProf

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-0466 is a vulnerability in AMD uProf, a performance analysis tool suite for x86-based applications on Windows, Linux, and FreeBSD.

The issue allows a local attacker with user privileges to write to memory mapped by the kernel. This happens because the driver creates a shared section object with a NULL security descriptor and exposes kernel pointers in shared memory, enabling potential writes to kernel-mapped memory.

Exploitation of this vulnerability could lead to system crashes or denial-of-service conditions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker with user privileges to write to kernel-shared memory, which can cause the system to crash or become unavailable.

The impact includes potential denial of service, disrupting normal system operations and possibly affecting system stability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper access control in AMD uProf allowing local user privilege writes to kernel-shared memory. Detection would focus on identifying the presence and version of AMD uProf installed on the system.

You can check the installed version of AMD uProf to determine if it is vulnerable by running commands such as:

• On Linux: `amduprofc --version` or `amduprofc -v`
• On Windows: Check the installed program version via Control Panel or run `amduprofc.exe --version` in Command Prompt or PowerShell if available.

Additionally, monitoring for unusual system crashes or denial-of-service symptoms related to kernel memory access could indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update AMD uProf to version 5.3 or higher, as AMD has released this update to address the vulnerability.

Until the update can be applied, restrict local user access to AMD uProf and avoid running it with user privileges that could exploit the vulnerability.

Monitoring system stability and access logs for suspicious activity related to AMD uProf usage is also recommended.

Useful 0 Not Useful 0