AMD Fixed a $10,000 Bug in Its Software but Didn't Pay the Researcher Who Discovered It
A console window that appeared at irregular intervals on a new PC triggered an investigation by an independent security researcher, uncovering a vulnerability in AMD's software ecosystem. Paul - the name he used publicly - conducted a reverse engineering analysis on the AMD AutoUpdater, documenting a Remote Code Execution (RCE) flaw that could be exploited via a Man-in-the-Middle attack.
By examining the AutoUpdater's configuration files, the researcher discovered (via Tom's Hardware) that the application retrieved an XML file containing metadata about available updates via HTTPS, but the references to the actual executables pointed to URLs with unencrypted HTTP schema. As a result, an attacker positioned on the network and able to intercept traffic could have replaced the downloaded package with an arbitrary one, which the software would then execute without verifying authenticity through digital signatures. Each update cycle thus became a potential compromise vector.
The formal report of the issue was submitted to AMD on February 6, 2026, through the official bug bounty program. Initially, AMD classified the flaw as ineligible for the bounty, asserting that the exploit required an active traffic interception scenario and tools considered optional, thus outside the formal scope of the program. However, an RCE of this nature would have qualified Paul for a $10,000 reward.
Later, the internal security team reassessed the case, recognizing its technical validity. AMD then communicated its intention to assign a CVE identifier, develop a patch, and publicly credit the discovery - but excluded any payment. In exchange, it requested the temporary removal of the technical post that Paul had published. The researcher agreed but later expressed regret over that decision.
Paul proposed the standard 90-day window for coordinated disclosure, a widely accepted practice in the industry. AMD responded by asking for an extension, justifying it by stating that the issue affected not only Ryzen Master but also other tools in its software portfolio, necessitating broader coordination before releasing the fixes. A request for an update on the progress made by the researcher before the deadline led to an additional extension: AMD invoked the need to allow customers time to adopt the corrected versions once made available. The embargo surpassed 120 days.
AMD finally communicated that the fix would be available on June 9, 124 days after the initial report. AMD announced it had redesigned the automatic update feature, moving it from the installer to the main application and fully protecting the connections via HTTPS. The researcher verified that the new version downloads the drivers securely, but raised a technical concern: the integrity check applied to the downloaded files would rely on CRC-32, an algorithm capable of detecting accidental transmission errors but lacking cryptographic properties. CRC-32 cannot guarantee protection against intentional manipulations by a motivated attacker, unlike a verifiable digital signature.
Ironically, according to a Reddit user, the bug identified by Paul may have never been actively triggered since the code section in question was not even called, meaning that the update program was fundamentally flawed. Thus, AMD could not update the program because the update code did not work, making it necessary for users to download again.
Finally, the issue of economic recognition remains. AMD ended up confirming the validity of the report, fixing the problem, and attributing credit for the discovery to the researcher, but without granting any reward. A choice that risks sending a mixed message to the security community: a vulnerability can be serious enough to warrant a patch and a CVE, but not enough to be rewarded through the program created precisely to encourage such reports.