CVE-2021-26334: AMD Chipset Driver Information Disclosure Vulnerability

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-01 · updated 2026-06-17
Weakness: CWE-284

Description

The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.

Affected products

AMD μProf: before 3.4.494; before 3.4.502 — fixed in 3.4.494, 3.4.502

How to fix

Upgrade to a fixed version: AMD μProf 3.4.494, 3.4.502. Check the vendor advisory for mitigations.

References

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1016

Get alerted when CVE-2021-26334 or the next vulnerability affects your stack