CVE-2024-21922

HighCVSS 7.3/10Last modified Sep 26, 2026

Description

A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Nov 23, 2025
Last modified: Sep 26, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-219237.3Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary cod CVE-2024-219248.2SMM callout vulnerability within the AmdPlatformRasSspSmm driver could allow a ring 0 attacker to modify boot services handlers, potentially CVE-2024-219258.2Improper input validation within the AmdPspP2CmboxV2 driver may allow a privileged attacker to overwrite SMRAM, leading to arbitrary code ex CVE-2024-219275.0Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters i CVE-2024-21935.7A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre CVE-2024-219355.0Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands CVE-2024-219377.8Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially CVE-2024-219387.8Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation direct CVE-2024-219397.3Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achie CVE-2024-21947.2The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and CVE-2024-219445.3Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys CVE-2024-219457.3Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege e