Birkan Alhan

A null pointer dereference exists in the AMD Embedded SPI Flash driver. This issue could allow a local user to cause a loss of availability, which typically results in a system crash or denial of service.

The software contains an unquoted service path vulnerability that may allow local attackers to escalate privileges. Specifically, the issue relates to the configuration of the ActiveFaxServiceNT service. Attackers possessing write permissions to Program Files directories can potentially inject a malicious ActSrvNT.exe executable. When the service restarts, this could grant the attacker elevated system access.