CVE-2025-61970: Vitis Unified Privilege Escalation Flaw

CVE-2025-61970 Overview

CVE-2025-61970 is a local privilege escalation vulnerability in AMD Vitis™ Unified software on Windows. The installation path uses weak directory permissions, allowing a low-privileged local user to write arbitrary files into the directory. An attacker can place a malicious binary that a higher-privileged process later executes, resulting in binary hijacking. The weakness is classified as CWE-276 (Incorrect Default Permissions).

Critical Impact
A local, authenticated user with low privileges can plant executables in the Vitis Unified installation path and hijack execution flows, gaining code execution in the context of any user or service that invokes those binaries.

Affected Products

AMD Vitis™ Unified software on Windows
Installations relying on the default installation directory permissions
Environments where multiple users share a Windows host with Vitis Unified installed

Discovery Timeline

2026-08-11 - CVE-2025-61970 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2025-61970

Vulnerability Analysis

The Vitis™ Unified installer creates its installation directory with permissions that grant write access to non-administrative users. Windows applications frequently load libraries and helper executables from their installation directory. When a directory permits low-privileged writes, any local user can drop or replace binaries in that path.

A subsequent execution by a higher-privileged user, scheduled task, or service running from the Vitis Unified path will load the attacker-supplied binary. This produces code execution under the invoking account, which can include administrators. The attack requires only local access and low privileges, which reduces the barrier to exploitation on shared engineering workstations.

Root Cause

The root cause is incorrect access control (CWE-276) applied to the Vitis Unified installation directory. Standard user accounts inherit write permissions where only administrators should have them. This breaks the trust boundary between privileged binaries and unprivileged filesystem locations.

Attack Vector

Exploitation is local and requires an authenticated user on the Windows host. The attacker writes a malicious executable, DLL, or plugin into the Vitis Unified installation path. When a privileged user or process runs a Vitis component, Windows resolves and executes the planted binary. User interaction is required for the privileged invocation to occur. See the AMD Security Bulletin AMD-SB-8015 for vendor-supplied technical details.

Detection Methods for CVE-2025-61970

Indicators of Compromise

Unexpected .exe, .dll, or script files appearing in the Vitis Unified installation directory outside of installer or update activity.
Modification timestamps on Vitis binaries that do not correspond to a known AMD installation or patch event.
Executions of Vitis Unified binaries that spawn unusual child processes such as cmd.exe, powershell.exe, or network utilities.

Detection Strategies

Audit NTFS access control lists on the Vitis Unified installation path and flag any entry that grants write, modify, or full control to Users, Authenticated Users, or Everyone.
Monitor file creation and modification events in the installation directory using Windows Security Event ID 4663 with SACL auditing enabled.
Correlate binary writes in the installation path with the writing process token to identify low-privileged users planting executables.

Monitoring Recommendations

Enable EDR file integrity monitoring on the Vitis Unified installation directory and alert on writes from non-installer processes.
Log and review process creation events (Event ID 4688 or Sysmon Event ID 1) for Vitis binaries executed under elevated tokens.
Track parent-child process relationships to detect hijacked binaries launching unexpected tooling.

How to Mitigate CVE-2025-61970

Immediate Actions Required

Apply the remediation guidance provided in the AMD Security Bulletin AMD-SB-8015.
Restrict NTFS permissions on the Vitis Unified installation directory so that only Administrators and SYSTEM retain write access.
Inventory all Windows workstations with Vitis Unified installed and validate directory permissions across the fleet.

Patch Information

AMD has published guidance in AMD-SB-8015. Administrators should follow the bulletin to obtain the corrected installer or apply the recommended permission changes to existing installations.

Workarounds

Manually remove write permissions for non-administrative principals on the Vitis Unified installation path using icacls.
Relocate Vitis Unified to a directory under %ProgramFiles% where default ACLs restrict write access to administrators.
Restrict interactive logon on hosts running Vitis Unified to trusted engineering users only.

bash

# Configuration example: harden Vitis Unified installation directory ACLs
icacls "C:\Xilinx\Vitis" /remove:g "BUILTIN\Users"
icacls "C:\Xilinx\Vitis" /remove:g "Authenticated Users"
icacls "C:\Xilinx\Vitis" /grant:r "BUILTIN\Administrators:(OI)(CI)F"
icacls "C:\Xilinx\Vitis" /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"
icacls "C:\Xilinx\Vitis" /inheritance:r