How severe is CVE-2026-0427?

CVE-2026-0427 has a CVSS 4.0 base score of 4.6, rated medium severity.

Is CVE-2026-0427 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-0427?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-0427 have an EU (EUVD) identifier?

Yes. CVE-2026-0427 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-30501.

When was CVE-2026-0427 published?

CVE-2026-0427 was published on 2026-05-15 and last updated on 2026-06-17.

CVE-2026-0427

CVE-2026-0427 is a medium-severity vulnerability with a CVSS 4.0 base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-459.

Key facts

Severity: Medium (CVSS 4.0 base score 4.6)
EPSS exploit prediction: 0% (2nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-30501
Weakness: CWE-459
Published: 2026-05-15
Last modified: 2026-06-17

Description

Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared resources from another Guest VM, potentially resulting in the loss of confidentiality, integrity, or availability.

Frequently asked questions

What is CVE-2026-0427?: Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared resources from another Guest VM, potentially resulting in the loss of confidentiality, integrity, or availability.
How severe is CVE-2026-0427?: CVE-2026-0427 has a CVSS 4.0 base score of 4.6, rated medium severity.
Is CVE-2026-0427 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-0427?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-0427 have an EU (EUVD) identifier?: Yes. CVE-2026-0427 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-30501.
When was CVE-2026-0427 published?: CVE-2026-0427 was published on 2026-05-15 and last updated on 2026-06-17.

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6027.html

Other CWE-459 vulnerabilities

CVE-2023-36468 — Critical (CVSS 9.9): XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki…
CVE-2022-45347 — Critical (CVSS 9.8): Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session…
CVE-2021-45330 — Critical (CVSS 9.8): An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies…
CVE-2021-45706 — Critical (CVSS 9.8): An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
CVE-2021-32928 — Critical (CVSS 9.8): The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License…
CVE-2020-13451 — Critical (CVSS 9.8): An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to…

Browse all CWE-459 vulnerabilities →