{"id":"CVE-2021-26316","state":"PUBLISHED","title":"Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mod","description":"Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution.","publishedAt":"2023-01-10T19:46:46.575Z","updatedAt":"2025-04-09T15:19:17.090Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"AMD","products":[" AMD Ryzen 5000 Series "," AMD Ryzen 2000 Series","AMD Ryzen 3000 Series","AMD 1st Gen EPYC ","AMD 2nd Gen EPYC","AMD 3rd Gen EPYC"],"affected":[{"vendor":" AMD","product":"Ryzen 5000 Series ","packageName":"AGESA","defaultStatus":"affected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]},{"vendor":" AMD","product":"Ryzen 2000 Series","packageName":"AGESA","defaultStatus":"unaffected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]},{"vendor":"AMD","product":"Ryzen 3000 Series","packageName":"AGESA","defaultStatus":"unaffected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]},{"vendor":"AMD","product":"1st Gen EPYC ","packageName":"AGESA ","defaultStatus":"unaffected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]},{"vendor":"AMD","product":"2nd Gen EPYC","packageName":"AGESA","defaultStatus":"unaffected","versions":[{"version":"Various ","status":"affected"}],"platforms":["x86"]},{"vendor":"AMD","product":"3rd Gen EPYC","packageName":"AGESA","defaultStatus":"unaffected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]}],"references":["https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031","https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T19:48:13.210Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/26xxx/CVE-2021-26316.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-26316","state":"PUBLISHED","datePublished":"2023-01-10T19:46:46.575Z","dateUpdated":"2025-04-09T15:19:17.090Z","assignerShortName":"AMD","assignerOrgId":"b58fc414-a1e4-4f92-9d70-1add41838648","dateReserved":"2021-01-29T21:24:26.137Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution."}],"affected":[{"vendor":" AMD","product":"Ryzen 5000 Series ","packageName":"AGESA","defaultStatus":"affected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]},{"vendor":" AMD","product":"Ryzen 2000 Series","packageName":"AGESA","defaultStatus":"unaffected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]},{"vendor":"AMD","product":"Ryzen 3000 Series","packageName":"AGESA","defaultStatus":"unaffected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]},{"vendor":"AMD","product":"1st Gen EPYC ","packageName":"AGESA ","defaultStatus":"unaffected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]},{"vendor":"AMD","product":"2nd Gen EPYC","packageName":"AGESA","defaultStatus":"unaffected","versions":[{"version":"Various ","status":"affected"}],"platforms":["x86"]},{"vendor":"AMD","product":"3rd Gen EPYC","packageName":"AGESA","defaultStatus":"unaffected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]}],"references":[{"url":"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031","tags":["vendor-advisory"]},{"url":"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032","tags":["vendor-advisory"]}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"AMD","orgId":"b58fc414-a1e4-4f92-9d70-1add41838648","dateUpdated":"2023-01-11T07:01:59.843Z"},"datePublic":"2023-01-10T17:30:00.000Z","source":{"advisory":"AMD-SB-1031, AMD-SB-1032","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031","tags":["vendor-advisory","x_transferred"]},{"url":"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T20:19:20.402Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-09T15:18:38.823141Z","id":"CVE-2021-26316","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","type":"CWE","lang":"en","description":"CWE-20 Improper Input Validation"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-09T15:19:17.090Z"}}]}}}