CVE-2024-36342

HighCVSS 8.8/10Last modified Oct 27, 2026

Description

Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

Affected software

VendorProductVersions
AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7035 Series Processors with Radeon™ Graphics—
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7020 Series Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 7000 Series Desktop Processors—
AMDAMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ AI 300 Series Processors—
AMDAMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 8000 Series Desktop Processors—
AMDAMD Ryzen™ 9000 Series Desktop Processors—
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 4000 Series Desktop Processors—
AMDAMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics—
AMDAMD Ryzen™ 6000 Series Processors with Radeon™ Graphics—
AMDAMD Ryzen™ Embedded R2000 Series Processors—
AMDAMD Ryzen™ Embedded V2000 Series Processors—
AMDAMD Ryzen™ Embedded 8000 Series—
AMDAMD Ryzen™ Embedded 7000 Series Processors—
AMDAMD Radeon™ RX 5000 Series Graphics Products—
AMDAMD Radeon™ PRO W5000 Series Graphics Products—
AMDAMD Radeon™ RX 6000 Series Graphics Products—
AMDAMD Radeon™ PRO W6000 Series Graphics Products—
AMDAMD Radeon™ RX 7000 Series Graphics Products—
AMDAMD Radeon™ PRO W7000 Series Graphics Products—
AMDAMD Radeon™ RX 9000 Series Graphics Products—
AMDAMD Radeon™ RX Vega Series Graphics Cards—
AMDAMD Radeon™ PRO VII—
AMDAMD Instinct™ MI210—
AMDAMD Instinct™ MI250—
AMDAMD Instinct™ MI300A—
AMDAMD Instinct™ MI300X—
AMDAMD Instinct™ MI308X—
AMDAMD Instinct™ MI325X—
AMDAMD Radeon™ PRO V520 Graphics Products—
AMDAMD Radeon™ PRO V620 Graphics Products—
AMDAMD Radeon™ PRO V710 Graphics Products—

References

Timeline

Published
Sep 6, 2025
Last modified
Oct 27, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-363434.6Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bCVE-2024-363446.9Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the Trusted ExecutCVE-2024-363454.6Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an outCVE-2024-363466.0Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input daCVE-2024-363476.4Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicCVE-2024-363483.8A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMICVE-2024-363493.8A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, poteCVE-2024-36354.8The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users CVE-2024-363505.6A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting iCVE-2024-363528.4Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to aCVE-2024-363536.5Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over memory values potentialCVE-2024-363547.5Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys
CVE-2024-36342: High severity, CVSS 8.8 | Vulnix