CVE-2026-0461

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0461", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "state": "PUBLISHED", "assignerShortName": "AMD", "dateReserved": "2025-12-06T15:11:19.042Z", "datePublished": "2026-10-05T21:38:01.104Z", "dateUpdated": "2026-10-06T13:49:03.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2026-10-05T21:38:01.104Z"}, "affected": [{"defaultStatus": "affected", "vendor": "AMD", "product": "Zynq\u2122 UltraScale+ MPSoCs", "versions": [{"version": "2026.1", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "Zynq\u2122 UltraScale+ RFSoCs", "versions": [{"version": "2026.1", "status": "unaffected"}]}, {"defaultStatus": "affected", "vendor": "AMD", "product": "Kria SOMs", "versions": [{"version": "2026.1", "status": "unaffected"}]}], "datePublic": "2026-10-05T21:37:49.096Z", "descriptions": [{"lang": "en", "value": "Insufficient boundary validation in the USB boot mode implementation of AMD Zynq\u2122 UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insufficient boundary validation in the USB boot mode implementation of AMD Zynq\u2122 UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.<br>"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8029.html"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-06T13:48:53.434055Z", "id": "CVE-2026-0461", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T13:49:03.497Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AMD", "product": "Zynq\u2122 UltraScale+ MPSoCs", "versions": [{"status": "unaffected", "version": "2026.1"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "Zynq\u2122 UltraScale+ RFSoCs", "versions": [{"status": "unaffected", "version": "2026.1"}], "defaultStatus": "affected"}, {"vendor": "AMD", "product": "Kria SOMs", "versions": [{"status": "unaffected", "version": "2026.1"}], "defaultStatus": "affected"}], "datePublic": "2026-10-05T21:37:49.096Z", "references": [{"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8029.html"}], "x_generator": {"engine": "AMD PSIRT Automation 1.0"}, "descriptions": [{"lang": "en", "value": "Insufficient boundary validation in the USB boot mode implementation of AMD Zynq\u2122 UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.", "supportingMedia": [{"type": "text/html", "value": "Insufficient boundary validation in the USB boot mode implementation of AMD Zynq\u2122 UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "shortName": "AMD", "dateUpdated": "2026-10-05T21:38:01.104Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0461", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-06T13:48:53.434055Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-06T13:48:59.420Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-0461", "state": "PUBLISHED", "dateUpdated": "2026-10-05T21:38:01.104Z", "dateReserved": "2025-12-06T15:11:19.042Z", "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648", "datePublished": "2026-10-05T21:38:01.104Z", "assignerShortName": "AMD"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Zynq\u2122 UltraScale+ MPSoCs", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "2026.1"}]}, {"defaultStatus": "affected", "product": "Zynq\u2122 UltraScale+ RFSoCs", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "2026.1"}]}, {"defaultStatus": "affected", "product": "Kria SOMs", "vendor": "AMD", "versions": [{"status": "unaffected", "version": "2026.1"}]}], "source": "psirt@amd.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient boundary validation in the USB boot mode implementation of AMD Zynq\u2122 UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system."}], "id": "CVE-2026-0461", "lastModified": "2026-10-06T16:00:36.547", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@amd.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0461", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-06T13:48:53.434055Z", "version": "2.0.3"}}]}, "published": "2026-10-05T22:16:55.280", "references": [{"source": "psirt@amd.com", "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8029.html"}], "sourceIdentifier": "psirt@amd.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "psirt@amd.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "2026.1"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "Kria SOMs", "source": "cna", "vendor": "AMD"}, "product": "kria_som", "vendor": "amd"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "2026.1"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "Zynq\u2122 UltraScale+ MPSoCs", "source": "cna", "vendor": "AMD"}, "product": "zynq_ultrascale+", "vendor": "amd"}], "created": "2026-10-05T22:30:19.108101+00:00", "title": "USB Boot Mode Buffer Overflow in AMD Zynq UltraScale+ MPSoCs and RFSoCs", "updated": "2026-10-06T20:45:05.902047+00:00", "vendors": ["amd", "amd$PRODUCT$kria_som", "amd$PRODUCT$zynq_ultrascale+"]}