CVE-2025-48512

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attacker to achieve privilege escalation resulting in arbitrary code execution.

Metrics

CVSS 4.0 7.0/10CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
AMDAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Renoir")—
AMDAMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")—
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Picasso")—
AMDAMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")—
AMDAMD Ryzen™ 7020 Series Processors with Radeon™ Graphics (formerly codenamed "Mendocino")—
AMDAMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Dragon Range")—
AMDAMD Ryzen™ 7000 Series Desktop Processors (formerly codenamed "Raphael"/"Raphael X3D")—
AMDAMD Ryzen™ 3000 Series Desktop Processors (formerly codenamed "Matisse")—
AMDAMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors (formerly codenamed "Castle Peak")—
AMDAMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Barcelo R")—
AMDAMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors (formerly codenamed "Castle Peak")—
AMDAMD Ryzen™ Threadripper™ 3000 Processors (formerly codenamed "Castle Peak")—
AMDAMD Ryzen™ 9000HX Series Processors—
AMDAMD Ryzen™ AI 300 Series Processors (formerly codenamed "Strix Point")—
AMDAMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (formerly codenamed "Picasso")—
AMDAMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors (formerly codenamed "Chagall")—
AMDAMD Ryzen™ Threadripper™ 7000 Processors (formerly codenamed "Storm Peak")—
AMDAMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors (formerly codenamed "Storm Peak")—
AMDAMD Ryzen™ 7000 Series Desktop Processors (formerly codenamed "Raphael"/"Raphael-X3D")—
AMDAMD Ryzen™ 8000 Series Desktop Processors (formerly codenamed "Phoenix")—
AMDAMD Ryzen™ 8000 Series Desktop Processors (formerly codenamed "Phoenix")—
AMDAMD Ryzen™ 9000 Series Desktop Processors (formerly codenamed "Granite Ridge")—
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Cezanne")—
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Lucienne")—
AMDAMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Barcelo")—
AMDAMD Ryzen™ 4000 Series Desktop Processors (formerly codenamed "Renoir")—
AMDAMD Ryzen™ 5000 Series Desktop Processors (formerly codenamed "Vermeer")—
AMDAMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics (formerly codenamed "Cezanne")—
AMDAMD Ryzen™ 3000 Series Desktop Processors (formerly codenamed "Matisse")—
AMDAMD Ryzen™ 5000 Series Desktop Processors (formerly codenamed "Vermeer"/"Vermeer-X3D")—
AMDAMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")—
AMDAMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Dali")—
AMDAMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Dali")—
AMDAMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")—
AMDAMD Ryzen™ AI Max 300 Series Processors—
AMDAMD Ryzen™ Z1 Series Processors—
AMDAMD Ryzen™ Embedded R1000 Series Processors—
AMDAMD Ryzen™ Embedded R2000 Series Processors—
AMDAMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Raven Ridge")—
AMDAMD Ryzen™ Embedded V2000 Series Processors—
AMDAMD EPYC™ Embedded 8004 Series Processors—
AMDAMD Ryzen™ Embedded 8000 Series Processors—
AMDAMD Ryzen™ Embedded 7000 Series Processors—
AMDAMD EPYC™ Embedded 9005 Series Processors—
AMDAMD Ryzen™ Embedded 9000 Series Processors—
AMDAMD EPYC™ 9004 Series Processors—
AMDAMD EPYC™ 7003 Series Processors—
AMDAMD EPYC™ 7002 Series Processors—
AMDAMD EPYC™ 7001 Series Processors—
AMDAMD EPYC™ 4004 Series Processors—

References

Timeline

Published
May 15, 2026
Last modified
Jun 17, 2026
NVD status
Awaiting Analysis

Related CVEs from 2025

CVE-2025-485136.9Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memoCVE-2025-485144.0Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potCVE-2025-485155.4Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwCVE-2025-485166.9Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege toCVE-2025-485174.6Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guesCVE-2025-485186.9Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integCVE-2025-485198.5An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or wCVE-2025-48523.4A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknowCVE-2025-485206.9An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out-CVE-2025-485216.9Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) conditCVE-2025-485227.8In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code.CVE-2025-485237.8In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This
CVE-2025-48512: High severity, CVSS 7.0 | Vulnix