{"id":"CVE-2025-0043","kind":"vulnerability","aliases":["CVE-2025-0043"],"related":[],"title":"AMD Vivado Lab Solutions on Windows: install folder lets any signed-in user replace xcd.exe and escalate privileges","description":"Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution.","summary":"AMD-SB-8024: after installing Vivado Lab Solutions on Windows, the install path has wrong permissions. The binary bin\\unwrapped\\win64.o\\xcd.exe (seen in the 2024.1 install) can be modified by all users in the Authenticated Users group, so a low-privileged local user can replace it and gain higher privileges and run code. CVSS 4.0 7.0. AMD lists the fix as Vivado Lab Solutions 2026.1 (released 2026-06-23). No exploitation or PoC mentioned.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vivado Lab Solutions","fixed":["2026.1"],"affected":"< 2026.1 (Windows; 2024.1 named in bulletin, other earlier versions not enumerated)","ecosystem":"vendor"}],"ecosystems":[],"tags":["amd","fpga","linux","local-privilege-escalation","vendor","vivado-lab","windows"],"not_affected_if":["linux","no-vivado-lab-installed","single-user-machine","vivado-lab-not-installed"],"how_to_check":"Windows only. Check whether Vivado Lab Solutions is installed (e.g. C:\\Xilinx\\Vivado_Lab\\<version>) and the version is older than 2026.1. Run: icacls C:\\Xilinx\\Vivado_Lab\\<version>\\bin\\unwrapped\\win64.o\\xcd.exe. If Authenticated Users (or Users/Everyone) has Modify/Write/Full, you are exposed.","fix":"Upgrade Vivado Lab Solutions to 2026.1 or later (AMD mitigation release, 2026-06-23).","status":"open","published_at":"2026-11-12T20:18:13+00:00","first_seen_at":"2026-11-12T20:40:22+00:00","triaged_at":"2026-11-12T20:42:17+00:00","updated_at":"2026-11-12T20:45:44+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-12T20:42:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AMD Vivado Lab Solutions: wrong directory permissions let local users escalate privileges","impact":"high","summary":"AMD Vivado Lab Solutions sets incorrect directory permissions, so a local user with ordinary privileges can gain higher privileges. The sources say this can lead to arbitrary code execution.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["amd","vivado-lab","windows","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher privileges and runs arbitrary code","analyst_note":"Check AMD's security bulletin for affected versions, the fixed release and the specific directories with wrong permissions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["vivado-lab-not-installed"],"who_is_affected":"Machines where AMD Vivado Lab Solutions is installed and where more than one local user has access. The sources do not name affected versions or the directories involved, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":4522,"output_tokens":423,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check AMD's security bulletin for affected versions, the fixed release and the specific directories with wrong permissions.","search":"'-0043':22A,25A '-06':111B '-2025':21A,24A '-23':112B '2024.1':67B '2026':110B '2026.1':108B '4.0':98B '7.0':99B '8024':44B 'allow':127C 'amd':1A,29B,42B,100B,122C 'amd-sb':41B 'arbitrari':141C 'attack':133C 'authent':77B 'bin':60B 'binari':59B 'code':96B,142C 'could':126C 'cve':20A,23A 'cvss':97B 'directori':119C 'escal':18A,35B,135C 'execut':143C 'exploit':114B 'fix':103B 'folder':8A 'fpga':30B 'gain':91B 'group':79B 'higher':92B 'incorrect':118C 'instal':7A,46B,53B,68B 'lab':3A,27A,39B,48B,106B,124C 'let':9A 'linux':31B 'list':101B 'local':33B,85B,129C 'local-privilege-escal':32B 'low':83B 'low-privileg':82B 'mention':117B 'modifi':71B 'path':54B 'permiss':57B,120C 'poc':116B 'potenti':138C 'privileg':19A,34B,84B,93B,132C,137C 'releas':109B 'replac':15A,88B 'result':139C 'run':95B 'sb':43B 'seen':64B 'sign':12A 'signed-in':11A 'solut':4A,49B,107B,125C 'solutions':28A 'unwrap':61B 'user':14A,74B,78B,86B,131C 'user-privileg':130C 'vendor':36B 'vivado':2A,26A,38B,47B,105B,123C 'vivado-lab':37B 'win64.o':62B 'window':6A,40B,51B 'within':121C 'wrong':56B 'xcd.exe':16A,63B","nicknames":[],"mitigations":[],"who_affected":"Machines where AMD Vivado Lab Solutions is installed and where more than one local user has access. The sources do not name affected versions or the directories involved, so unknown.","tier":"B","verified":{"fix":{"at":"2026-11-12T20:45:44Z","by":"analyst","doc":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8024.html","run_id":3783},"products":{"at":"2026-11-12T20:45:44Z","by":"analyst","doc":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8024.html","run_id":3783},"how_to_check":{"at":"2026-11-12T20:45:44Z","by":"analyst","doc":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8024.html","run_id":3783}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["labsolutions","vivadolabsolutions"],"ptokens":["lab","solutions","vivado"],"labels":["amd","fpga","high","linux","localprivilegeescalation","vendor","vivadolab","windows"],"campaign_type":null,"search_a":"'-0043':22A,25A '-2025':21A,24A 'amd':1A 'cve':20A,23A 'escal':18A 'folder':8A 'instal':7A 'lab':3A,27A 'let':9A 'privileg':19A 'replac':15A 'sign':12A 'signed-in':11A 'solut':4A 'solutions':28A 'user':14A 'vivado':2A,26A 'window':6A 'xcd.exe':16A","search_b":"'-06':111B '-23':112B '2024.1':67B '2026':110B '2026.1':108B '4.0':98B '7.0':99B '8024':44B 'amd':29B,42B,100B 'amd-sb':41B 'authent':77B 'bin':60B 'binari':59B 'code':96B 'cvss':97B 'escal':35B 'exploit':114B 'fix':103B 'fpga':30B 'gain':91B 'group':79B 'higher':92B 'instal':46B,53B,68B 'lab':39B,48B,106B 'linux':31B 'list':101B 'local':33B,85B 'local-privilege-escal':32B 'low':83B 'low-privileg':82B 'mention':117B 'modifi':71B 'path':54B 'permiss':57B 'poc':116B 'privileg':34B,84B,93B 'releas':109B 'replac':88B 'run':95B 'sb':43B 'seen':64B 'solut':49B,107B 'unwrap':61B 'user':74B,78B,86B 'vendor':36B 'vivado':38B,47B,105B 'vivado-lab':37B 'win64.o':62B 'window':40B,51B 'wrong':56B 'xcd.exe':63B","search_c":"'allow':127C 'amd':122C 'arbitrari':141C 'attack':133C 'code':142C 'could':126C 'directori':119C 'escal':135C 'execut':143C 'incorrect':118C 'lab':124C 'local':129C 'permiss':120C 'potenti':138C 'privileg':132C,137C 'result':139C 'solut':125C 'user':131C 'user-privileg':130C 'vivado':123C 'within':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T20:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@amd.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-0043","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0043","severity":null,"published_at":"2026-11-12T20:18:13+00:00","modified_at":"2026-11-12T20:18:13+00:00","first_seen_at":"2026-11-12T20:40:22+00:00","fetched_at":"2026-11-12T20:40:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-0043:3783","url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8024.html","severity":null,"published_at":"2026-11-12T20:45:44+00:00","modified_at":"2026-11-12T20:45:44+00:00","first_seen_at":"2026-11-12T20:45:44+00:00","fetched_at":"2026-11-12T20:45:44+00:00","note":"Read AMD-SB-8024 (primary). Windows-only; Linux tag from triage not supported by bulletin. Affected range below 2026.1 is inferred from mitigation release; only 2024.1 path is named. No exploitation/PoC found; no social search done (low-profile local LPE).","cites":["https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8024.html"]}],"documents":[{"id":138450,"url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8024.html","title":"AMD-SB-8024 Vivado Lab Solutions Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}