CVE-2022-23826

LowCVSS 1.8/10Last modified Nov 10, 2026

Description

A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially leading to a loss of integrity.

Metrics

CVSS 4.0 1.8/10CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AMDAMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics—
AMDAMD Ryzen™ Embedded R1000 Series Processors—
AMDAMD Ryzen™ Embedded R2000 Series Processors—
AMDAMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Raven Ridge")—
AMDAMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Picasso")—
AMDAMD Radeon™ RX 5000 Series Graphics Products—
AMDAMD Radeon™ PRO W5000 Series Graphics Products—
AMDAMD Radeon™ RX 6000 Series Graphics Products—
AMDAMD Radeon™ VII—
AMDAMD Radeon™ RX Vega Series Graphics Cards—
AMDAMD Radeon™ PRO W6000 Series Graphics Product—
AMDAMD Radeon™ PRO W6000 Series Graphics Products—
AMDAMD Radeon™ PRO WX 8000/9000 Series Graphics Cards—
AMDAMD Radeon™ PRO VII—
AMDAMD Instinct™ MI250—
AMDAMD Instinct™ MI210—
AMDAMD Radeon™ Instinct™ MI25—
AMDAMD Radeon™ PRO V520—
AMDAMD Radeon™ PRO V620—

References

Timeline

Published
May 15, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2022

CVE-2022-238298.2A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native SystCVE-2022-23836.1The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading tCVE-2022-238305.3SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.CVE-2022-238317.5Insufficient validation of the IOCTL input buffer in AMD μProf may allow an attacker to send an arbitrary buffer leading to a potential WindCVE-2022-238337.5An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to mCVE-2022-238358.1The Visual Voice Mail (VVM) application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an appliCVE-2022-238377.5In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads thCVE-2022-23844.8The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege usersCVE-2022-238489.8In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerabilCVE-2022-238496.6The biometric lock in Devolutions Password Hub for iOS before 2021.3.4 allows attackers to access the application because of authentication CVE-2022-23858.8A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalatCVE-2022-238507.8xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document.