CVE-2025-0041 - Vulnerability Details - OpenCVE

Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00138.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8015.html

History

Thu, 13 Aug 2026 03:15:00 +0000

Type	Values Removed	Values Added
Title	Uncontrolled Search Path Allows Local Code Execution in Vitis Embedded SFD

Wed, 12 Aug 2026 21:30:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Search Path Allows Local Code Execution in Vitis Embedded SFD

Wed, 12 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-427
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 11 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.
References		https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8015.html
Metrics		cvssV4_0 `{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L'}`

MITRE

Status: PUBLISHED

Assigner: AMD

Published: 2026-08-11T16:51:07.459Z

Updated: 2026-08-12T13:16:56.601Z

Reserved: 2024-11-21T16:18:08.715Z

Link: CVE-2025-0041

Vulnrichment

Updated: 2026-08-12T13:16:47.610Z

NVD

Status : Awaiting Analysis

Published: 2026-08-11T17:17:42.140

Modified: 2026-08-12T20:50:58.370

Link: CVE-2025-0041

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-13T03:00:09Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0041", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2024-11-21T16:18:08.715Z", "datePublished": "2026-08-11T16:51:07.459Z", "dateUpdated": "2026-08-12T13:16:56.601Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2026-08-11T16:51:07.459Z"}, "affected": [{"defaultStatus": "affected", "vendor": "AMD", "product": "Vitis\u2122 Embedded Single File Download (SFD) for Windows", "versions": [{"version": "2026.1", "status": "unaffected"}]}], "datePublic": "2026-08-11T16:48:00.165Z", "descriptions": [{"lang": "en", "value": "Uncontrolled search paths in the Vitis\u2122 Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Uncontrolled search paths in the Vitis\u2122 Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.<br>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Security Vulnerability"}]}], "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8015.html"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-427", "lang": "en", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T13:16:28.196798Z", "id": "CVE-2025-0041", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T13:16:56.601Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0041", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T13:16:28.196798Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T13:16:47.610Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AMD", "product": "Vitis\u2122 Embedded Single File Download (SFD) for Windows", "versions": [{"status": "unaffected", "version": "2026.1"}], "defaultStatus": "affected"}], "datePublic": "2026-08-11T16:48:00.165Z", "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8015.html"}], "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "descriptions": [{"lang": "en", "value": "Uncontrolled search paths in the Vitis\u2122 Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.", "supportingMedia": [{"type": "text/html", "value": "Uncontrolled search paths in the Vitis\u2122 Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Security Vulnerability"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2026-08-11T16:51:07.459Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0041", "state": "PUBLISHED", "dateUpdated": "2026-08-12T13:16:56.601Z", "dateReserved": "2024-11-21T16:18:08.715Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2026-08-11T16:51:07.459Z", "assignerShortName": "AMD"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Vitis\u2122 Embedded Single File Download (SFD) for Windows", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "2026.1"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled search paths in the Vitis\u2122 Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user to create arbitrary code execution."}], "id": "CVE-2025-0041", "lastModified": "2026-08-12T20:50:58.370", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0041", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T13:16:28.196798Z", "version": "2.0.3"}}]}, "published": "2026-08-11T17:17:42.140", "references": [{"source": "[email protected]", "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8015.html"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}