CVE-2026-0465: AMD Ryzen Master Use-After-Free Flaw

CVE-2026-0465 Overview

CVE-2026-0465 is a use-after-free (UAF) vulnerability [CWE-416] in the AMD Ryzen™ Master Utility Driver. A local attacker with high privileges can trigger the flaw to access kernel memory, potentially causing a loss of availability on the affected system. AMD disclosed the issue in security bulletin AMD-SB-9020.

The vulnerability requires local access and elevated privileges, which limits remote exploitation scenarios. Successful exploitation impacts system availability by corrupting kernel memory state managed by the vulnerable driver. No public exploit code has been published, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Local exploitation can corrupt kernel memory through the Ryzen Master Utility Driver, leading to system instability or denial of service on Windows hosts where the driver is installed.

Affected Products

AMD Ryzen™ Master Utility Driver
Windows systems with the AMD Ryzen Master Utility installed
Refer to AMD Security Bulletin AMD-SB-9020 for specific affected versions

Discovery Timeline

2026-08-11 - CVE-2026-0465 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-0465

Vulnerability Analysis

The flaw is a use-after-free condition classified under [CWE-416]. The Ryzen Master Utility Driver frees a kernel object but retains a reference to the freed memory. Subsequent operations dereference this stale pointer, allowing an attacker to influence kernel memory that has been reallocated.

Exploitation requires local code execution with high privileges on the target host. The attack does not require user interaction. The primary impact is on availability; there is no reported impact to confidentiality or integrity of user data outside the driver context.

EPSS data indicates a low probability of exploitation activity at this time. However, kernel drivers signed by AMD are attractive targets for bring-your-own-vulnerable-driver (BYOVD) techniques, where attackers load the legitimate signed driver on a system they control to gain kernel-level primitives.

Root Cause

The driver manages internal objects tied to IOCTL requests issued from user mode. A code path releases an allocation without invalidating pointers held elsewhere in the driver. A follow-up IOCTL then reuses the dangling pointer, dereferencing memory that the kernel allocator may have handed to a different object.

Attack Vector

An attacker with local, privileged access opens a handle to the Ryzen Master Utility Driver device object and issues a crafted sequence of IOCTL calls. The sequence forces the free of a tracked object, then triggers the use of the stale reference. The corrupted state produces a kernel bug check or an exploitable memory condition. Consult AMD Security Bulletin AMD-SB-9020 for authoritative technical detail.

Detection Methods for CVE-2026-0465

Indicators of Compromise

Unexpected BSOD or bug check events referencing the AMD Ryzen Master driver (commonly AMDRyzenMasterDriver.sys)
Loading of the Ryzen Master driver on systems that do not host the Ryzen Master Utility user application
Non-administrative processes opening handles to the Ryzen Master driver device object

Detection Strategies

Monitor Windows kernel crash dumps and Windows Error Reporting telemetry for faults attributed to the Ryzen Master driver image
Alert on driver load events (Sysmon Event ID 6) where the loaded image is the Ryzen Master driver on hosts without the corresponding user-mode utility installed
Hunt for IOCTL activity from unusual parent processes targeting the Ryzen Master driver device path

Monitoring Recommendations

Enable Microsoft's vulnerable driver blocklist and review its coverage after AMD publishes updated driver hashes
Baseline expected driver versions across the fleet and alert on downgrades to a vulnerable version
Track privileged local logons followed by driver installation events, which may indicate BYOVD staging

How to Mitigate CVE-2026-0465

Immediate Actions Required

Inventory endpoints for the presence of the AMD Ryzen Master Utility and its driver
Apply the fixed version referenced in AMD Security Bulletin AMD-SB-9020
Remove the Ryzen Master Utility from systems that do not require CPU tuning, such as servers and standard corporate workstations
Restrict local administrator rights to reduce the population of users who can exploit the flaw

Patch Information

AMD has published remediation guidance in AMD Security Bulletin AMD-SB-9020. Update the Ryzen Master Utility to the version identified in the bulletin. Confirm that the older driver binary is removed from C:\Windows\System32\drivers\ after the upgrade.

Workarounds

Uninstall the AMD Ryzen Master Utility on hosts that do not need overclocking or memory tuning features
Add the vulnerable driver hash to the Microsoft Vulnerable Driver Blocklist and enforce it via Windows Defender Application Control (WDAC)
Enforce least privilege so that standard users cannot install or interact with the Ryzen Master driver

bash

# Verify presence of the AMD Ryzen Master driver on a Windows host
sc.exe query type= driver | findstr /I "AMDRyzenMaster"

# Enable Microsoft's vulnerable driver blocklist via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f