CVE-2024-36342: Heap Overflow in AMD GPU Driver Across the Instinct Data Centre Accelerator Line
| CVE | Score | Affected | Patched | Disclosed |
|---|---|---|---|---|
| CVE-2024-36342 | 8.8 High | AMD Instinct MI210/MI250/MI300A/MI300X/MI308X/MI325X plus consumer/professional GPU lines | ROCm 6.4 / latest AMD graphics drivers | August 2025 |
Discovered by Maher Azzouzi.
For executives
AMD's August 2025 graphics security bulletin disclosed a heap overflow vulnerability in the AMD GPU driver rated CVSS 8.8. The flaw affects the full AMD Instinct data centre accelerator line. Improper input validation in the kernel-mode GPU driver allows a local attacker with low privileges to trigger a heap overflow, potentially achieving arbitrary code execution.
The vulnerability
CVE-2024-36342 is a heap overflow in the AMD GPU driver's kernel-mode layer, rooted in improper input validation (CWE-20). A local user with low privileges sends malformed input to the kernel-mode driver layer. The driver fails to validate that the input specifies a valid index, position, or offset within the expected range, causing a heap overflow.
The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): local access, low complexity, low privileges, no user interaction, changed scope, high impact to confidentiality, integrity, and availability. CVSS 8.8.
Companion vulnerability: CVE-2024-36352
The same bulletin disclosed CVE-2024-36352 (CVSS 8.4), discovered by Daniel Jampen and Nicola Stauffer. CVE-2024-36352 is an improper validation of a pointer supplied by the attacker, potentially leading to arbitrary writes or denial of service.
Patch
For AMD Instinct data centre accelerators: update to ROCm 6.4 or later. For consumer and professional graphics cards: install the latest AMD graphics drivers. For Dell PowerEdge servers: apply Dell security advisory DSA-2025-322.