Read the docs
TI-2020-10252 Aliases CVE-2020-12891GHSA-49c8-cmr9-7c94

Uncontrolled search path in AMD Radeon Software

Priority LOW 34CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location which is in path environment variable.

Why it matters now

EPSS 0.00254 17th percentileScored 2026-11-07
Fix Fixed Radeon Software (AMD): 21.4.1Radeon Pro Software for Enterprise (AMD): 21.Q2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDRadeon SoftwareRadeon Driver to before 21.4.121.4.1Patch availableCNA
AMDRadeon Pro Software for EnterpriseEnterprise Driver to before 21.Q221.Q2Patch availableCNA
  • Radeon Software VendorAMD Affected Radeon Driver to before 21.4.1 Fixed in 21.4.1 Patch available CNA
  • Radeon Pro Software for Enterprise VendorAMD Affected Enterprise Driver to before 21.Q2 Fixed in 21.Q2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:amd:radeon_pro_software:*:*:*:*:enterprise:*:*:*before 21.q2VulnerableAMD
cpe:2.3:a:amd:radeon_software:*:*:*:*:*:*:*:*before 21.4.1VulnerableAMD
  • cpe:2.3:a:amd:radeon_pro_software:*:*:*:*:enterprise:*:*:* Versions before 21.q2 Vulnerable ·AMD
  • cpe:2.3:a:amd:radeon_software:*:*:*:*:*:*:*:* Versions before 21.4.1 Vulnerable ·AMD

Remediation

  • Fix · CNA Radeon Software (AMD) Fixed in 21.4.1
  • Fix · CNA Radeon Pro Software for Enterprise (AMD) Fixed in 21.Q2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-12891
  2. 2026-10-03 Alias added: GHSA-49c8-cmr9-7c94

References

Advisory 1

  • TI-2021-08184 Improper access control in AMD Radeon RX 6000 Series & PRO W6000 Series CVSS 3.1HIGH 7.8
  • TI-2021-08212 Improper signature verification in AMD Radeon RX 5000 Series & PRO W5000 Series CVSS 3.1HIGH 7.8
  • TI-2021-08213 Out-of-bounds write in AMD Radeon RX 5000 Series & PRO W5000 Series CVSS 3.1HIGH 7.8
  • TI-2020-10293 Improper input validation in AMD Radeon Software CVSS 3.1HIGH 7.8
  • TI-2020-10292 Improper input validation in AMD Radeon Software CVSS 3.1HIGH 7.8
  • TI-2020-10291 Out-of-bounds write in AMD Radeon Software CVSS 3.1HIGH 7.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences