CVE-2025-0014: AMD Ryzen AI Privilege Escalation Flaw

CVE-2025-0014 Overview

CVE-2025-0014 is a local privilege escalation vulnerability affecting the AMD Ryzen AI software installation folder. The flaw stems from incorrect default permissions [CWE-276] applied during installation, which allow low-privileged users to modify files within a directory that executes with elevated rights. An attacker with local access can leverage these permissions to achieve arbitrary code execution in a higher-privileged security context. AMD documented the issue in Security Bulletin SB-7037.

Critical Impact
A local, authenticated user can escalate privileges and execute arbitrary code by tampering with files in the AMD Ryzen AI installation directory.

Affected Products

AMD Ryzen AI software (per AMD Security Bulletin SB-7037)
Windows systems with AMD Ryzen AI components installed
Refer to the AMD Security Bulletin SB-7037 for specific version details

Discovery Timeline

2025-04-02 - CVE-2025-0014 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0014

Vulnerability Analysis

The vulnerability is classified as Incorrect Default Permissions [CWE-276]. During installation, the AMD Ryzen AI package configures its installation folder with Access Control Lists (ACLs) that grant write or modify rights to non-administrative users. Because binaries and support files inside that folder are subsequently launched by higher-privileged processes, an attacker can substitute or alter these files to run attacker-controlled code with elevated rights.

Exploitation requires local access and low privileges. User interaction is also required, which typically maps to an administrator or service triggering execution of the tampered component. Successful exploitation compromises confidentiality, integrity, and availability of the host.

Root Cause

The root cause is misconfigured filesystem permissions applied by the installer. Rather than restricting write access to administrators and SYSTEM, the installation directory inherits or is set with permissions that allow standard users to modify contents. This violates the principle of least privilege and creates a directory that is writable by a lower-privileged principal but executed by a higher-privileged one.

Attack Vector

An attacker with a local, low-privileged account writes a malicious DLL or executable into the AMD Ryzen AI installation folder, or replaces a legitimate binary. When a privileged process, scheduled task, or service subsequently loads the file, the attacker's code runs in that elevated context. Common techniques for this class of flaw include DLL planting, binary replacement, and hijacking of search-order loading. No verified proof-of-concept code is publicly available.

Detection Methods for CVE-2025-0014

Indicators of Compromise

Unexpected file creation, modification, or replacement in the AMD Ryzen AI installation directory by non-administrative accounts
New or altered .dll or .exe files in the Ryzen AI folder that are not signed by AMD
Processes spawned by AMD Ryzen AI binaries that exhibit anomalous behavior such as spawning cmd.exe, powershell.exe, or performing network activity

Detection Strategies

Audit ACLs on the AMD Ryzen AI installation folder and flag entries granting write access to Users, Authenticated Users, or Everyone
Enable Windows object access auditing on the installation directory to log write and modify events by non-privileged principals
Correlate file modification events with subsequent privileged process launches to identify potential exploitation chains

Monitoring Recommendations

Monitor Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime) for changes in the AMD Ryzen AI directory
Alert on loading of unsigned or non-AMD-signed modules by Ryzen AI processes using Sysmon Event ID 7 (ImageLoad)
Track privilege escalation patterns where a low-integrity process modifies a file later executed at a higher integrity level

How to Mitigate CVE-2025-0014

Immediate Actions Required

Apply the updates referenced in AMD Security Bulletin SB-7037 as soon as they are available for your platform
Inventory endpoints running AMD Ryzen AI software and prioritize patching on multi-user or shared systems
Restrict interactive local access to systems that cannot be immediately updated

Patch Information

AMD has published guidance and fixed versions in AMD Security Bulletin SB-7037. Administrators should download the updated Ryzen AI installer from AMD and reinstall or upgrade affected components to apply corrected default permissions.

Workarounds

Manually harden ACLs on the AMD Ryzen AI installation folder to remove write and modify rights from non-administrative principals
Remove AMD Ryzen AI software from systems where it is not required until a fixed version is deployed
Enforce application control policies such as Windows Defender Application Control (WDAC) or AppLocker to block execution of unsigned binaries from the affected directory

bash

# Example: audit and restrict permissions on the Ryzen AI install folder (Windows)
icacls "C:\Program Files\AMD\RyzenAI"
icacls "C:\Program Files\AMD\RyzenAI" /remove:g "BUILTIN\Users"
icacls "C:\Program Files\AMD\RyzenAI" /remove:g "Authenticated Users"
icacls "C:\Program Files\AMD\RyzenAI" /grant:r "BUILTIN\Administrators:(OI)(CI)F" "NT AUTHORITY\SYSTEM:(OI)(CI)F"