CVE-2024-21922CWE-426

CVE-2024-21922

High · published November 23, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

⚡ A sneaky DLL hijacking vulnerability in AMD StoreMI™ could let attackers escalate privileges and run arbitrary code—yikes! 🔥 Think of it like a waiter who confuses a customer's order and starts serving extra helpings from the kitchen without permission. If they can serve whatever they want, it can lead to a disastrous menu! If an attacker pulls this off, they could gain high-level access and execute malicious code—compromising your system's integrity and putting your data at serious risk. This could lead to unauthorized changes, data theft, or worse!

Put simply

Think of it like a waiter who confuses a customer's order and starts serving extra helpings from the kitchen without permission. If they can serve whatever they want, it can lead to a disastrous menu! This DLL hijacking vulnerability allows an attacker to replace a legitimate DLL with a malicious one, enabling privilege escalation and potential remote code execution due to insufficient validation of the path to the DLL.

What to do

If an attacker pulls this off, they could gain high-level access and execute malicious code—compromising your system's integrity and putting your data at serious risk. This could lead to unauthorized changes, data theft, or worse! To secure your systems, update AMD StoreMI™ to the latest version immediately. Additionally, consider implementing stricter controls on DLL loading paths to prevent unauthorized replacements. Staying vigilant is key! You've got this! With a few quick steps, your system will be safer in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00145 · 3.5th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2025-11-23T22:15Z
References (1)
EPSS history
Timeline
  • 23 NOV 16:26Z
    A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution
    cvelistv5