What happened from the reporting to the public disclosure of the remote code execution vulnerability found in AMD's automatic update tool?
A vulnerability has been discovered in AMD's automatic update tool that could lead to remote code execution. Security researcher MrBruh reported the vulnerability to AMD, but it was deemed ineligible for a bounty because it presupposes a man-in-the-middle attack, leading to widespread debate about how AMD should respond.
The RCE that AMD wouldn't fix! | MrBruh's Epic Blog
The problem arose because the AMD Auto Updater automatic update tool used HTTPS to retrieve update information, but the URL for the executable file that was actually downloaded used HTTP. Furthermore, Mr. Bruh decompiled the code and confirmed that no cryptographic signature verification was performed on the downloaded executable file, and it was executed directly.
This vulnerability means that if an attacker is on the same network or has the capability to modify data along the communication path, they could potentially replace legitimate update files with malicious executables. Because this often appears as a normal automatic update to the user, it's possible that spyware or ransomware could be executed with administrator privileges.
Mr. Bruh discovered this vulnerability on January 27, 2026, and reported it to AMD on February 6. However,
After MrBruh published his blog post, which became a hot topic on Hacker News, AMD's PSIRT contacted them to say they would investigate further. AMD explained that 'even if Intigriti determines that it is not eligible for a bounty, we will confirm its validity as a vulnerability internally,' and further indicated that they would issue a CVE, fix the vulnerability, and grant researcher credits.
Meanwhile, AMD requested MrBruh to delete the blog post and wait to publish it until a formal response was complete. MrBruh complied, but explained that subsequent communication was not proactive, and the publication date was ultimately June 9, 2026, 124 days after the initial report.
AMD eventually publicly announced this issue as ' AMD Auto Updater Vulnerability ' and assigned the code CVE-2026-40677. AMD lists AMD Management Console , AMD Ryzen Master , and AMD µProf as affected products. As a mitigation measure, it is recommended to update AMD Management Console to version 14.0.0, AMD Ryzen Master to version 2.14.3, and AMD µProf to version 5.3 or later.
However, MrBruh claims that while AMD explained that 'Ryzen Master moves the automatic update function from the installer to the application layer, update communication is protected by HTTPS, and update files undergo signature verification,' all he actually saw was a CRC-32 check. Although CRC-32 can be used to detect data corruption, it is different from cryptographic signature verification to prevent tampering by attackers, so MrBruh criticizes AMD's explanation as inaccurate.
Furthermore, Mr. Bruh also mentioned another issue: the AMD Auto Updater may be unable to handle the redirection from ati.com to drivers.amd.com, potentially causing the update process to crash or stop. He pointed out that this created a contradictory situation where the vulnerability might not actually reach a stage where it could be exploited, while fixing the vulnerable update mechanism would require updating the update mechanism itself.
Hacker News also suggested that 'the decision to exclude a bug from the bug bounty program does not necessarily mean that it has no impact as a vulnerability.' One comment pointed out that 'man-in-the-middle attacks are excluded not because they 'take over a PC,' but simply because they fall outside the scope of the specific bug bounty program's objectives.'
Gamers Nexus, a YouTube channel that covers topics related to gaming PCs and other hardware, also covered the issue, criticizing AMD for 'acting dishonestly towards researchers and then changing the rules afterward.'
AMD Gaslights Security Researcher, Changes Rules Retroactively - YouTube
Related Posts:
