CVE-2024-21960

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Incorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-219616.0Improper restriction of operations within the bounds of a memory buffer in PCIe® Link could allow an attacker with access to a guest virtualCVE-2024-219628.6Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in pCVE-2024-219667.3A DLL hijacking vulnerability in the AMD Ryzen™ Master Utility could allow an attacker to achieve privilege escalation, potentially resultiCVE-2024-21974.3The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settingsCVE-2024-219704.4Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentiCVE-2024-219715.5Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, rCVE-2024-219725.3An out of bounds write vulnerability in the AMD Radeon™ user mode driver for DirectX® 11 could allow an attacker with access to a malformed CVE-2024-219747.8Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary cCVE-2024-219757.8Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary cCVE-2024-219768.8Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary cCVE-2024-219773.2Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potCVE-2024-219787.9Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakag
CVE-2024-21960: High severity, CVSS 7.3 | Vulnix