Read the docs
TI-2022-10655 Aliases CVE-2022-27677GHSA-gjmv-6p6x-5mrf

Improper privilege management in AMD Ryzen™ Master

Priority LOW 35CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.

Summary

Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privilege escalation and code execution by the lower privileged user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00224 13th percentileScored 2026-11-07
Fix Fixed Ryzen™ Master ( AMD): 2.10.1.2287

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDRyzen™ Masterbefore 2.10.1.22872.10.1.2287Patch availableCNA
  • Ryzen™ Master VendorAMD Affected before 2.10.1.2287 Fixed in 2.10.1.2287 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:amd:ryzen_master:*:*:*:*:*:*:*:*before 2.10.1.2287VulnerableAMD
  • cpe:2.3:o:amd:ryzen_master:*:*:*:*:*:*:*:* Versions before 2.10.1.2287 Vulnerable ·AMD

Remediation

  • Fix · CNA Ryzen™ Master ( AMD) Fixed in 2.10.1.2287

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27677
  2. 2026-10-03 Alias added: GHSA-gjmv-6p6x-5mrf

References

Advisory 1

  • TI-2020-10271 A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any… CVSS 3.1HIGH 7.8
  • TI-2023-07016 Improper input validation in AMD Ryzen™ Master CVSS 3.1MEDIUM 6.7
  • TI-2023-07012 Improper input validation in AMD Ryzen™ Master CVSS 3.1MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences