CVE-2020-12927

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may allow any authenticated user to escalate privileges to NT authority system.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-749

Affected software

Vendor	Product	Versions
n/a	AMD VBIOS Flash Tool SDK	Mitigated in version 3.12

References

https://www.amd.com/en/corporate/product-securityVendor Advisory
https://www.amd.com/en/corporate/product-securityVendor Advisory

Timeline

Published: Nov 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-129287.8A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT aut CVE-2020-129297.8Improper parameters validation in some trusted applications of the PSP contained in the AMD Graphics Driver may allow a local attacker to by CVE-2020-12937.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'CVE-2020-129307.8Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially l CVE-2020-129317.8Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentiall CVE-2020-129335.5A denial of service vulnerability exists in the D3DKMTEscape handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A s CVE-2020-12947.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServi CVE-2020-129447.8Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution.CVE-2020-129467.1Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service.CVE-2020-12958.8An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.CVE-2020-129517.0Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations.CVE-2020-129545.5A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI