CVE-2026-0466: AMD uProf Local Privilege Escalation and Denial of Service

Technical summary

CVE-2026-0466 is a local privilege escalation vector rooted in improper access control (CWE-497) within AMD uProf's memory management. A locally authenticated user can bypass restrictions designed to protect kernel-shared memory, write arbitrary data to that region, and trigger a denial-of-service condition. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the requirement for local access and user-level privileges, combined with high availability impact but no confidentiality or integrity compromise of protected data.

Business impact

Availability disruptions are the primary concern. An attacker with local access could repeatedly crash systems running uProf, forcing restarts and service downtime. In environments where uProf is widely deployed for performance analysis—such as HPC clusters or development labs—coordinated exploitation could affect multiple machines simultaneously. Systems depend on continuous operation; even brief unavailability can disrupt workflows, delay analysis, and degrade user productivity.

Affected systems

All versions of AMD uProf are potentially affected by this vulnerability. Organizations should verify their deployed uProf versions against AMD's advisory and patch guidance. Systems running uProf in multi-user environments or where uProf processes are exposed to untrusted local users face elevated risk.

Exploitability

The vulnerability is straightforward to exploit by any user with local shell access, requiring no special tools or complex techniques. However, the requirement for local privileges and interactive access to the system keeps this from being a critical remote threat. The absence of the vulnerability from CISA's Known Exploited Vulnerabilities (KEV) catalog as of the current record suggests active exploitation has not been widely reported, though this should not be interpreted as a sign of low risk in high-value targets.

Remediation

Contact AMD for the patched version of uProf applicable to your deployment. Apply patches to all systems running uProf—prioritizing production environments and systems shared among multiple users. Where immediate patching is not feasible, restrict local access to uProf to trusted users only, use OS-level access controls to limit who can run uProf processes, and monitor system logs for unexpected crashes or denial-of-service patterns.

Patch guidance

AMD will release updates to address this access control flaw. Check AMD's official uProf download page and security advisories for the corrected version number. Apply patches in a staged manner: first to development and testing environments to validate compatibility, then to production systems. Coordinate patching with scheduled maintenance windows to minimize disruption. Verify successful remediation by confirming the patched uProf version is in use and retesting access controls.

Detection guidance

Monitor for repeated system crashes or kernel panic events coinciding with uProf process activity, particularly when triggered by non-administrative users. Audit local user accounts with access to uProf and review privilege escalation attempts in system logs. Endpoint Detection and Response (EDR) tools should flag suspicious write operations to kernel memory regions originating from user-space processes. Log all uProf process launches and correlate with system availability events.

Why prioritize this

Although assigned a MEDIUM CVSS score, this vulnerability warrants prompt but not emergency response. Prioritize patching systems where (1) uProf is deployed in multi-user environments, (2) local security boundaries are weak or not consistently enforced, or (3) the system's role makes even brief downtime costly. Organizations with single-user workstations running uProf can defer patching slightly but should not skip it.

Risk score, explained

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H assigns a score of 5.5. Local attack vector (AV:L) and low attack complexity (AC:L) reflect the straightforward nature of exploitation. Low privileges (PR:L) accurately capture the requirement for a local user account. No impact on confidentiality or integrity (C:N/I:N) reflects that this is a denial-of-service channel, not a data theft or system takeover vector. High availability impact (A:H) reflects the severity of potential service disruption.

Frequently asked questions