Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-0461

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download r

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMD

Description

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AMD Zynq™ UltraScale+ MPSoCs

Default version status: affected

  • 2026.1unaffected

AMD Zynq™ UltraScale+ RFSoCs

Default version status: affected

  • 2026.1unaffected

AMD Kria SOMs

Default version status: affected

  • 2026.1unaffected

References