AMD Vitis Security Bulletin: Multiple LPE/RCE and Key Leakage Vulnerabilities (CVE-2025-48505, etc.)

Vulnerability Overview AMD has released a security advisory (AMD-SB-8015) regarding the Vitis™ tools, identifying multiple security vulnerabilities. These vulnerabilities may allow low-privilege users to escalate privileges, thereby enabling the editing or loading of unauthorized files on a local Windows machine, or even achieving arbitrary code execution via DLL injection. Scope of Impact Affected Products: Vitis™ Embedded Single File Download (SFD) for Windows, Vitis™ Libraries - Security Module, Vitis™ Unified Installer for FPGAs & Adaptive SoCs in Windows. Vulnerability Details: - CVE-2026-43606: The Vitis™ Libraries ECDSA secp256k1 component exhibits observable timing variations, potentially allowing attackers to perform timing analysis or electromagnetic radiation attacks to leak private keys. - CVE-2025-48505: Weak permissions in the Vitis™ Unified installation path may allow low-privilege users to escalate privileges and execute arbitrary code. - CVE-2025-48506: Uncontrolled search paths in the Vitis™ Unified installation directory may lead to DLL injection and arbitrary code execution. - CVE-2025-0041: Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) may allow low-privilege users to create arbitrary code. - CVE-2025-61970: Weak permissions in the Vitis™ Unified installation path may allow low-privilege users to create arbitrary code and execute binary hijacking. Remediation AMD has released mitigation measures with the following specific release dates: Vitis™ Embedded Single File Download (SFD) for Windows: - CVE-2025-0041: 2026-06-23 - CVE-2025-61970: 2026-06-23 Vitis™ Libraries - Security Module: - CVE-2026-43606: 2026-06-23 Vitis™ Unified Installer for FPGAs & Adaptive SoCs in Windows: - CVE-2025-48505: 2026-06-23 - CVE-2025-48506: 2026-06-23 Acknowledgments Thanks to the following researchers for their participation in the AMD Vulnerability Reward Program: Mohamed Amine Saïdani (Pwni) - CVE-2025-48505, CVE-2025-48506 Researcher "ycdxb" - CVE-2025-0041, CVE-2025-61970 Researcher "bunny0417" - CVE-2026-43606 Revision History 2026-08-11: Initial Release Disclaimer The contents of this document are for reference purposes only. AMD does not warrant the accuracy, completeness, or applicability of the information. AMD hardware, software, or other products may contain security risks, and AMD is not responsible for any damages arising from the use of these products. Copyright Information © 2026 Advanced Micro Devices, Inc. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

AMD Vitis Security Bulletin: Multiple LPE/RCE and Key Leakage Vulnerabilities (CVE-2025-48505, etc.)