CVE-2025-8087: AMD Power Design Manager DLL Hijacking

CVE-2025-8087 Overview

CVE-2025-8087 is a DLL hijacking vulnerability in AMD Power Design Manager. The flaw resides in the application's uninstallation process, where the software loads dynamic-link libraries (DLLs) from insecure search paths. A local attacker with low-level privileges can plant a malicious DLL that the uninstaller loads with elevated rights, resulting in arbitrary code execution and privilege escalation.

The issue is tracked under CWE-427: Uncontrolled Search Path Element. Exploitation requires local access and user interaction to trigger the uninstall workflow.

Critical Impact
Successful exploitation allows a local low-privileged attacker to execute arbitrary code with elevated privileges by placing a crafted DLL that the AMD Power Design Manager uninstaller loads during removal.

Affected Products

AMD Power Design Manager (Windows) — uninstallation component
Refer to the AMD Security Bulletin AMD-SB-8016 for the specific affected version ranges

Discovery Timeline

2026-08-11 - CVE-2025-8087 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2025-8087

Vulnerability Analysis

CVE-2025-8087 is a DLL hijacking flaw in AMD Power Design Manager's uninstallation routine. When a user initiates uninstallation, the process attempts to load one or more DLLs without specifying a fully qualified path. Windows falls back to its default DLL search order, which includes writable directories accessible to non-administrative users.

An attacker who can write a DLL of the expected name into a search-path directory can force the elevated uninstaller to load attacker-controlled code. Because the uninstaller executes with elevated permissions, the injected code inherits those privileges. This grants the attacker the ability to run arbitrary commands, install persistence, or modify protected system state.

The attack requires local access and user interaction, since the uninstall must be triggered. However, on shared workstations or in environments where administrators periodically remove the software, the exploitation window is realistic.

Root Cause

The root cause is improper control of the DLL search path during process initialization, classified as CWE-427. The uninstaller does not enforce a secure loading mechanism such as LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32, nor does it validate the signature of the loaded module.

Attack Vector

An attacker with local, low-privileged access places a malicious DLL, matching the name of a library the uninstaller loads, into a directory searched before the legitimate library. When an administrator or the same user initiates the uninstall of AMD Power Design Manager, the crafted DLL is loaded into the elevated process, and its DllMain entry point executes attacker code. Refer to the AMD Security Bulletin AMD-SB-8016 for vendor-specific technical details.

Detection Methods for CVE-2025-8087

Indicators of Compromise

Unexpected DLL files present in the AMD Power Design Manager installation directory or in per-user writable paths that match names referenced by the uninstaller
Uninstaller processes spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe
New scheduled tasks, services, or registry Run keys created immediately following an AMD Power Design Manager uninstall event

Detection Strategies

Monitor Sysmon Event ID 7 (Image Loaded) for DLLs loaded by the AMD uninstaller from non-standard paths outside of System32 or the signed installation directory
Alert on unsigned or unexpectedly signed modules loaded into any AMD Power Design Manager process
Correlate uninstall activity (MSI or msiexec.exe invocation) with subsequent process creation events that deviate from a known-good baseline

Monitoring Recommendations

Audit user-writable directories that appear in the DLL search order for the presence of DLLs matching library names used by AMD utilities
Review endpoint telemetry for privilege transitions where a low-integrity user session leads to a high-integrity process executing arbitrary code
Enable command-line auditing to capture uninstall sequences and downstream child processes for retrospective hunting

How to Mitigate CVE-2025-8087

Immediate Actions Required

Apply the vendor update referenced in the AMD Security Bulletin AMD-SB-8016 before performing any uninstall of AMD Power Design Manager
Restrict local write access to directories in the DLL search path for the AMD Power Design Manager binaries
Limit which accounts can perform software uninstallation on workstations that have the affected software installed

Patch Information

AMD has published guidance in AMD Security Bulletin AMD-SB-8016. Administrators should consult the bulletin for fixed version numbers and installation instructions, then upgrade prior to executing any uninstall workflow.

Workarounds

Delay uninstallation of AMD Power Design Manager until the patched version is installed
Verify the integrity and location of every DLL adjacent to the uninstaller binary before invoking removal
Where possible, remove the software from an elevated administrator session in a clean directory that non-administrative users cannot modify

bash

# Example: verify signatures of DLLs adjacent to the AMD Power Design Manager binaries
Get-ChildItem 'C:\Program Files\AMD\Power Design Manager' -Filter *.dll -Recurse |
    ForEach-Object { Get-AuthenticodeSignature $_.FullName } |
    Where-Object { $_.Status -ne 'Valid' }