CVE-2025-0035

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Unquoted search path within AMD Cloud Manageability Service can allow a local attacker to escalate privileges, potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-00363.2In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause d CVE-2025-00376.6In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow ac CVE-2025-00386.6In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow acces CVE-2025-00405.3Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with phys CVE-2025-00414.6Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user CVE-2025-00444.8An out-of-bounds read in power management firmware by a malicious local attacker with low privileges could potentially lead to a partial los CVE-2025-00456.9Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, pot CVE-2025-00467.0Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.CVE-2025-00494.3When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes th CVE-2025-00505.9Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valha CVE-2025-00518.7Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.CVE-2025-00528.3Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.