AMD Chipset Driver Information Disclosure Vulnerability
Priority MEDIUM 45CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.
Why it matters now
EPSS 0.01208 68th percentileScored 2026-11-07
Fix Fixed μProf Tool (AMD): 3.4.494
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | μProf Tool | μProf Tool to before 3.4.494 | 3.4.494 | Patch available | CNA |
- μProf Tool VendorAMD Affected μProf Tool to before 3.4.494 Fixed in 3.4.494 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:* | before 3.4.494 | Vulnerable | AMD |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:* | before 3.4.502 | Vulnerable | AMD |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:* Versions before 3.4.494 Vulnerable ·AMD
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:amd:amd_uprof:*:*:*:*:*:*:*:* Versions before 3.4.502 Vulnerable ·AMD
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Remediation
- Fix · CNA μProf Tool (AMD) Fixed in 3.4.494
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26334
- 2026-10-03 Alias added: GHSA-4xjc-qqh2-pgwj
References
More Amd Uprof vulnerabilities
- TI-2022-10654 Improper input validation in AMD μProf CVSS 3.1HIGH 7.5
- TI-2022-07847 Improper input validation in AMD μProf CVSS 3.1HIGH 7.5
- TI-2023-07014 Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD uProf may… CVSS 3.1HIGH 7.8
- TI-2023-07013 Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may… CVSS 3.1MEDIUM 5.5
- TI-2023-07009 Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD μProf may… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-26334 · CVE Program
- CVE-2021-26334 · NVD
- FIRST EPSS
- GHSA-4xjc-qqh2-pgwj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences