VIVADO LAB SOLUTIONS · CVE-2025-0043 · Vendor
FIX → 2026.1 ✓ verified
AMD-SB-8024: after installing Vivado Lab Solutions on Windows, the install path has wrong permissions. The binary bin\unwrapped\win64.o\xcd.exe (seen in the 2024.1 install) can be modified by all users in the Authenticated Users group, so a low-privileged local user can replace it and gain higher privileges and run code. CVSS 4.0 7.0. AMD lists the fix as Vivado Lab Solutions 2026.1 (released 2026-06-23). No exploitation or PoC mentioned.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Machines where AMD Vivado Lab Solutions is installed and where more than one local user has access. The sources do not name affected versions or the directories involved, so unknown.
Not affected if linux, no-vivado-lab-installed, single-user-machine, vivado-lab-not-installed
Who cares amd, fpga, linux, local-privilege-escalation, vivado-lab, windows
Upgrade to 2026.1
Upgrade Vivado Lab Solutions to 2026.1 or later (AMD mitigation release, 2026-06-23).
Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.