{"id":"CVE-2021-26346","state":"PUBLISHED","title":"Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resul","description":"Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.","publishedAt":"2023-01-10T19:50:24.146Z","updatedAt":"2025-04-09T15:14:19.086Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"AMD","products":[" AMD Ryzen 5000 Series"],"affected":[{"vendor":" AMD","product":"Ryzen 5000 Series","packageName":"AGESA","defaultStatus":"affected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]}],"references":["https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"],"weaknesses":["CWE-190"],"ingestedAt":"2026-10-29T19:48:13.210Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/26xxx/CVE-2021-26346.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-26346","state":"PUBLISHED","datePublished":"2023-01-10T19:50:24.146Z","dateUpdated":"2025-04-09T15:14:19.086Z","assignerShortName":"AMD","assignerOrgId":"b58fc414-a1e4-4f92-9d70-1add41838648","dateReserved":"2021-01-29T21:24:26.146Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service."}],"affected":[{"vendor":" AMD","product":"Ryzen 5000 Series","packageName":"AGESA","defaultStatus":"affected","versions":[{"version":"various ","status":"affected"}],"platforms":["x86"]}],"references":[{"url":"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"AMD","orgId":"b58fc414-a1e4-4f92-9d70-1add41838648","dateUpdated":"2023-01-11T07:01:59.843Z"},"datePublic":"2023-01-10T17:30:00.000Z","source":{"advisory":"AMD-SB-1031","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T20:26:24.647Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-09T15:14:14.715212Z","id":"CVE-2021-26346","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","type":"CWE","lang":"en","description":"CWE-190 Integer Overflow or Wraparound"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-09T15:14:19.086Z"}}]}}}