Security News Chipmaker Patch Tuesday: Intel and AMD Patch 70 Vulnerabilities

[Brownie2019]

Content source

https://www.securityweek.com/chipmaker-patch-tuesday-intel-and-amd-patch-70-vulnerabilities/

The two chip giants have published over two dozen advisories describing recently identified security defects.
Chipmaker Patch Tuesday
Intel and AMD have released over two dozen advisories on May 2026 Patch Tuesday, addressing 70 vulnerabilities across their product portfolios.
Intel published 13 advisories describing 24 security defects, including one critical and eight high-severity flaws.
The critical bug, tracked as CVE-2026-20794 (CVSS score of 9.3), is described as a buffer overflow issue in the Data Center Graphics Driver for VMware ESXi software that could be exploited for privilege escalation and potentially for code execution.
Intel’s update for the product also resolves two high-severity out-of-bounds write and read weaknesses that could lead to denial-of-service (DoS) conditions and potentially to data corruption or disclosure.
The chip maker also addressed high-severity vulnerabilities in Vision software, Endpoint Management Assistant (EMA), UEFI firmware for the Slim Bootloader, and QuickAssist Technology (QAT) software drivers for Windows.
Successful exploitation of the flaws could lead to DoS conditions and privilege escalation, and potentially arbitrary code execution.
Chipmaker Patch Tuesday
Intel and AMD have released over two dozen advisories on May 2026 Patch Tuesday, addressing 70 vulnerabilities across their product portfolios.
Intel published 13 advisories describing 24 security defects, including one critical and eight high-severity flaws.
The critical bug, tracked as CVE-2026-20794 (CVSS score of 9.3), is described as a buffer overflow issue in the Data Center Graphics Driver for VMware ESXi software that could be exploited for privilege escalation and potentially for code execution.
Intel’s update for the product also resolves two high-severity out-of-bounds write and read weaknesses that could lead to denial-of-service (DoS) conditions and potentially to data corruption or disclosure.
The chip maker also addressed high-severity vulnerabilities in Vision software, Endpoint Management Assistant (EMA), UEFI firmware for the Slim Bootloader, and QuickAssist Technology (QAT) software drivers for Windows.
Successful exploitation of the flaws could lead to DoS conditions and privilege escalation, and potentially arbitrary code execution.
Advertisement. Scroll to continue reading.
The remaining security defects addressed by Intel on Tuesday are medium-severity bugs affecting AI Playground, Display Virtualization for Windows driver, 800 Series Ethernet Linux driver, NPU drivers, UEFI firmware, Server Firmware Update Utility, QAT drivers for Windows, and some Intel processors.
AMD published 15 advisories covering 45 vulnerabilities, including one critical-severity flaw and two dozen high-severity issues.
Tracked as CVE-2026-0481 (CVSS score of 9.2), the critical bug impacts the AMD Device Metrics Exporter (ROCm ecosystem), which exposes port 50061 on all network interfaces by default, allowing unauthenticated users to access the GPU-Agent gRPC(Google Remote Procedure call) server.
“Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability,” AMD explains.
The company has addressed high-severity weaknesses within Secure Processor (ASP), general-purpose input/output controller (GPIO), Revenera InstallShield, Ionic cloud driver for ESXi, RAID driver, chipset drivers, CPU operation cache on Zen 2‑based products, graphics and datacenter accelerator products, EPYC and EPYC Embedded processor platforms, and some optional software tools.

Successful exploitation of these issues could lead to privilege escalation, arbitrary code execution, and arbitrary read/write access to the victim VM/process data.

 

[Bot]

Short version

This looks like a summary of May 2026 Intel and AMD security advisories, but I cannot verify the quoted text from here, so I would avoid treating every detail as confirmed until it is matched against the official vendor advisories.

What it means in practice

If the advisory summary is accurate, the main takeaway is simple:

• Intel and AMD both patched multiple security issues
• Some of them are rated high or critical
• Several affected components appear to be enterprise-facing, such as drivers, firmware, ESXi-related components, ROCm, server utilities, and management tools
• The practical risk depends heavily on whether the affected component is actually installed and exposed in your environment

That last point is important. A critical CVSS score does not automatically mean every home user or every system is in immediate danger.

Likely higher-priority cases

Based on the text you posted, the updates would generally deserve faster attention on systems using:

• VMware ESXi-related Intel graphics or AMD driver components
• AMD ROCm / Device Metrics Exporter, especially if the service is reachable over the network
• Intel EMA, QAT, firmware update tools, or enterprise management components
• EPYC servers, datacenter accelerators, RAID/chipset drivers, or optional enterprise software tools mentioned by AMD

For a typical consumer PC, many of these may not apply at all.

Reasonable response order

1. Check the official Intel and AMD security advisory pages for the exact CVEs and affected versions
2. Confirm whether the named component is actually installed in your system or environment
3. Prioritize internet-exposed, management, virtualization, firmware, and server-related components first
4. Apply vendor patches, updated drivers, firmware, or mitigation guidance
5. If immediate patching is not possible, reduce exposure by disabling unnecessary services, restricting network access, and limiting administrative access

A note on the AMD ROCm item

If the quote is accurate, the “binds to all interfaces by default” detail is especially worth attention because network exposure often raises the practical risk more than a local-only flaw. In that case, restricting access to the service or host firewalling would be a sensible temporary mitigation until patching is completed.

A note on firmware and driver advisories

Firmware, chipset, graphics, and storage driver advisories can be harder to assess because impact depends on:

• Exact hardware generation
• OEM-customized firmware or drivers
• Whether the vulnerable module is enabled or used
• Hypervisor, datacenter, or enterprise deployment context

So the safest approach is to rely on the vendor bulletin and your OEM/server vendor release notes, not on the summary alone.

Bottom line

The post suggests a meaningful Patch Tuesday for both chip vendors, especially for enterprise, virtualization, GPU compute, and server environments. The correct next step is to verify the CVEs against Intel and AMD’s official advisories and patch any affected installed components based on exposure and system role.