CVE-2026-0481 PUBLISHED

Assigner: AMD
Reserved: 06.12.2025 Published: 15.05.2026 Updated: 15.05.2026

Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	AMD
Product	AMD Instinct™ MI210
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

Vendor	AMD
Product	AMD Instinct™ MI250
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

Vendor	AMD
Product	AMD Instinct™ MI300A
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

Vendor	AMD
Product	AMD Instinct™ MI300X
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

Vendor	AMD
Product	AMD Instinct™ MI325X
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

Vendor	AMD
Product	AMD Instinct™ MI350X
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

Vendor	AMD
Product	AMD Instinct™ MI355X
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

Vendor	AMD
Product	AMD Instinct™ MI308X
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

Vendor	AMD
Product	AMD Instinct™ MI250X
Versions	Default: affected Version DME v1.4.1.2 and v1.4.0.1 is unaffected

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6031.html

Problem Types

CWE-1327 Binding to an Unrestricted IP Address CWE