Information disclosure in AMD Radeon Software
Priority LOW 25CWE-200Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass.
Why it matters now
EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed AMD Radeon Software (AMD): 20.7.1, 21.Q2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | AMD Radeon Software | Radeon Software to before 20.7.1; Radeon Pro Software for Enterprise to before 21.Q2 | 20.7.1, 21.Q2 | Patch available | CNA |
- AMD Radeon Software VendorAMD Affected Radeon Software to before 20.7.1; Radeon Pro Software for Enterprise to before 21.Q2 Fixed in 20.7.1, 21.Q2 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:amd:radeon_pro_software:*:*:*:*:enterprise:*:*:* | before 21.q1 | Vulnerable | AMD |
| cpe:2.3:a:amd:radeon_software:*:*:*:*:*:*:*:* | before 20.7.1 | Vulnerable | AMD |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:amd:radeon_pro_software:*:*:*:*:enterprise:*:*:* Versions before 21.q1 Vulnerable ·AMD
- cpe:2.3:a:amd:radeon_software:*:*:*:*:*:*:*:* Versions before 20.7.1 Vulnerable ·AMD
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA AMD Radeon Software (AMD) Fixed in 20.7.1, 21.Q2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
AMD Radeon Software 20.7.1, 21.Q2
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2020-10293 Improper input validation in AMD Radeon SoftwarePriority LOW 34
- TI-2020-10292 Improper input validation in AMD Radeon SoftwarePriority LOW 34
- TI-2020-10291 Out-of-bounds write in AMD Radeon SoftwarePriority LOW 34
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12987
More AMD Radeon Pro Software vulnerabilities
- TI-2021-08184 Improper access control in AMD Radeon RX 6000 Series & PRO W6000 Series CVSS 3.1HIGH 7.8
- TI-2021-08212 Improper signature verification in AMD Radeon RX 5000 Series & PRO W5000 Series CVSS 3.1HIGH 7.8
- TI-2021-08213 Out-of-bounds write in AMD Radeon RX 5000 Series & PRO W5000 Series CVSS 3.1HIGH 7.8
- TI-2020-10293 Improper input validation in AMD Radeon Software CVSS 3.1HIGH 7.8
- TI-2020-10292 Improper input validation in AMD Radeon Software CVSS 3.1HIGH 7.8
- TI-2020-10291 Out-of-bounds write in AMD Radeon Software CVSS 3.1HIGH 7.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences