CVE-2022-23826

Description

A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially leading to a loss of integrity.

Overview

State

—

Assigner (CNA)

—

CVSS severity

medium

CVSS score

6.3 / 10

CVSS vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Effective score

6.3 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2022-23826

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-05-15 03:16:20 UTC

NVD last modified

2026-05-15 14:10:17 UTC

EPSS score

0.0002 (probability of exploitation in next 30 days)

EPSS percentile

3.70% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD-assigned CWE(s): CWE-367 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2022-28755

Assigner

AMD

Published

May 15, 2026, 2:30:16 AM

Updated

May 15, 2026, 1:20:55 PM

EUVD base score (CVSS 4.0)

1.8 / 10
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

EUVD-reported EPSS

0.0200

Vendors

AMD

Products

AMD Radeon™ RX Vega Series Graphics Cards (patch: AMD Software: Adrenalin Edition 25.5.1 (23.19.23.01 pre-RDNA))

AMD Radeon™ RX 5000 Series Graphics Products (patch: AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09))

AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Picasso") (patch: 120A)

AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (patch: ComboAM4v2 PI 1.2.0.8)

AMD Instinct™ MI210 (patch: ROCm 6.4.2)

AMD Radeon™ RX 6000 Series Graphics Products (patch: AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09))

AMD Radeon™ PRO W6000 Series Graphics Products (patch: AMD Software: PRO Edition 25.Q2 (25.10.10))

AMD Radeon™ PRO WX 8000/9000 Series Graphics Cards (patch: AMD Software: PRO Edition 25.Q2 (23.19.23.01 pre-RDNA))

AMD Radeon™ PRO V620 (patch: Contact your AMD Customer Engineering representative)

AMD Ryzen™ Embedded R1000 Series Processors (patch: EmbeddedPI-FP5_1.2.0.A)

AMD Radeon™ PRO VII (patch: AMD Software: PRO Edition 25.Q2 (23.19.23.01 pre-RDNA))

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (patch: PicassoPI-FP5 1.0.0.E)

AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics (patch: PicassoPI-FP5 1.0.0.E)

AMD Radeon™ VII (patch: AMD Software: Adrenalin Edition 25.5.1 (23.19.23.01 pre-RDNA))

AMD Ryzen™ Embedded R2000 Series Processors (patch: EmbeddedR2KPI-FP5_1.0.0.2)

AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Raven Ridge") (patch: EmbeddedPI-FP5_1.2.0.A)

AMD Radeon™ PRO W5000 Series Graphics Products (patch: AMD Software: PRO Edition 25.Q2 (25.10.10))

AMD Instinct™ MI250 (patch: ROCm 6.4.2)

AMD Radeon™ PRO V520 (patch: Contact your AMD Customer Engineering representative)

AMD Radeon™ Instinct™ MI25 (patch: Contact your AMD Customer Engineering representative)

AMD Radeon™ PRO W6000 Series Graphics Product (patch: AMD Software: PRO Edition 25.Q2 (25.10.10))

Aliases

GHSA-2vw3-5r88-9c5p

ENISA description: A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially leading to a loss of integrity.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2022-23826 tenable:nvd.nist.gov
• https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4017.html tenable:www.amd.com
• https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6027.html tenable:www.amd.com
• https://www.cve.org/CVERecord?id=CVE-2022-23826 tenable:www.cve.org
• https://www.first.org/epss/ tenable:www.first.org

• Mitigate RedSun Zero-Day Without A Patch | Qualys
  web:blog.qualys.com

  Key Takeaways RedSun is a critical zero-day vulnerability in Microsoft Defender that allows low-privileged users to gain SYSTEM access No patch is currently available, leaving all Defender-enabled Windows systems potentially exposed Qualys VMDR detects affected assets instantly (QID 92382) TruRisk™ Eliminate enables immediate mitigation , removing exploitability without waiting for a fix ...

  2026-05-26 03:08 UTC
• Security Advisory Bulletin 064 | Ubiquiti Community
  web:community.ui.com

  Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

  2026-05-26 03:08 UTC
• Security Update Guide - Microsoft
  web:msrc.microsoft.com

  The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

  2026-05-26 03:08 UTC
• Nvd - Cve-2026-33826
  web:nvd.nist.gov

  An official website of the United States government Here's how you know

  2026-05-26 03:08 UTC
• Vulnerability Remediation vs Mitigation: Which Strategy Wins in ...
  web:securityboulevard.com

  Cybersecurity vulnerabilities pose significant risks to organizations in today's digital landscape. Left unaddressed, these vulnerabilities can lead to data breaches, financial losses, and reputational damage. Organizations must decide how to tackle vulnerabilities—through remediation , mitigation , or a combination of both. But which strategy is more effective? This blog explores the ...

  2026-05-26 03:08 UTC
• A guide to vulnerability remediation vs mitigation | @Bugcrowd
  web:www.bugcrowd.com

  Vulnerability mitigation is typically considered a temporary or interim solution. While mitigation measures can reduce the immediate risk associated with vulnerabilities, they may not provide a permanent fix . Organizations should aim to prioritize and plan for complete vulnerability remediation whenever feasible and allocate resources accordingly.

  2026-05-26 03:08 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-05-26 03:08 UTC
• Critical Patch Updates, Critical Security Patch Updates ... - Oracle
  web:www.oracle.com

  Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

  2026-05-26 03:08 UTC
• Vulnerability Remediation vs. Mitigation: What are the Differences ...
  web:www.secure.com

  Learn the difference between vulnerability remediation and mitigation , and how a risk-based strategy can strengthen your security posture.

  2026-05-26 03:08 UTC
• Windows 11 April 2026 Update tested: What's new, improved and fixed
  web:www.windowslatest.com

  Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

  2026-05-26 03:08 UTC

Only Available for Registered Users. Sign in to view.