High severity · published Nov 24, 2025
CVE-2025-48510
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AΜ
AMD μProf · AMD
All versions, or not specified · source: vendor
UP
Uprof · Amd
before 5.0.1174; before 5.0.1223; before 5.0.1479 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-48510
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-48510
Mitigation
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-9019.html
More from AMD μProf
7.7
CVE-2026-40677
The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary code execution
7.0
CVE-2025-61969
Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resulting in arbitrary code execution
5.5
CVE-2026-28237
Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of availability
5.5
CVE-2026-0466
Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potentially resulting in crash or denial of…
5.5
CVE-2025-29933
Improper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a crash or denial of service