CVE-2026-43598
waiting for further signalsZero needs more public information before it can validate it.GHSA-h97m-6c64-h5x2 ↗EUVD-2026-93987 ↗
description
RCCL deployments associated with the listed AMD Instinct MI accelerators are affected by an input-validation flaw. A compromised peer rank or an attacker able to reach the collective-communication network may potentially execute code by triggering unsafe pointer handling.
mitigation
Restrict RCCL communication to trusted, isolated networks and allow only authenticated, trusted ranks to join collective jobs. Apply AMD-provided updates when available; no fixed version is recorded in the advisory.
outcome
Contextual: an exploit technique exists, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-06 20:06Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-43598
{ "etk_id": "ETK-2026-841", "cve_id": "CVE-2026-43598", "display_id": "CVE-2026-43598", "ghsa_id": "GHSA-h97m-6c64-h5x2", "euvd_id": "EUVD-2026-93987", "status": "published", "anchor_state": "anchored", "title": "Improper input validation in AMD RCCL", "summary": "RCCL deployments associated with the listed AMD Instinct MI accelerators are affected by an input-validation flaw. A compromised peer rank or an attacker able to reach the collective-communication network may potentially execute code by triggering unsafe pointer handling.", "mitigation": "Restrict RCCL communication to trusted, isolated networks and allow only authenticated, trusted ranks to join collective jobs. Apply AMD-provided updates when available; no fixed version is recorded in the advisory.", "vendor": "AMD", "product": "AMD Instinct™ MI210", "affected": [ { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI210", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI250", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI300A", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI300X", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI325X", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI350X", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI355X", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI308X", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "AMD Instinct™ MI250X", "purl": null } ], "cwes": [ 822 ], "cvss_score": 7.7, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "epss_score": 0.0046, "epss_percentile": 0.3842, "epss_asof": "2026-10-20", "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 13.27892545, "t0_at": "2026-10-06T20:06:56.948000+00:00", "signals": { "trigger_signal": { "at": "2026-10-06T20:06:56.948000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-06T20:06:56.948000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43598" } } }
published 2026-10-07 03:40Z
last change 2026-10-21 16:41Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.