A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be…
Priority LOW 24Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure.
Why it matters now
EPSS 0.00237 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | Ryzen™ Series | various | — | No fix listed | CNA |
| AMD | Athlon™ Series | various | — | No fix listed | CNA |
- Ryzen™ Series VendorAMD Affected various Fixed in — No fix listed CNA
- Athlon™ Series VendorAMD Affected various Fixed in — No fix listed CNA
CPE configurations NVD · 71
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:amd:radeon_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:o:amd:ryzen_3_2200u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_3_2200u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_3_2300u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_3_2300u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_3_5125c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_3_5125c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_3_5400u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_3_5400u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:athlon_3050ge_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
- cpe:2.3:a:amd:radeon_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:o:amd:ryzen_3_2200u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_3_2200u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_3_2300u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_3_2300u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_3_5125c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_3_5125c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_3_5400u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_3_5400u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:athlon_3050ge_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
Show 61 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:amd:athlon_3050ge:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:athlon_3150ge_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:athlon_3150ge:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:athlon_3150g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:athlon_3150g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_3_5425c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_3_5425c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_3_5425u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_3_5425u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_2500u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_2500u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_2600_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_2600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_2600h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_2600h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_2600x_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_2600x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5560u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5560u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5600h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5600h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5600hs_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5600hs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5600u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5600u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5600x_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5600x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5625c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5625c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5625u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5625u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5700g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5700g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_5_5700ge_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_5_5700ge:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_2700u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_2700u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_2700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_2700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_2700x_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_2700x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_2800h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_2800h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_5800h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_5800h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_5800hs_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_5800hs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_5800u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_5800u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_5825c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_5825c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_7_5825u_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_7_5825u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_9_5980hx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_9_5980hx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_9_5980hs_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_9_5980hs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_9_5900hx_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_9_5900hx:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_9_5900hs_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_9_5900hs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
- cpe:2.3:h:amd:athlon_3050ge:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:athlon_3150ge_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:athlon_3150ge:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:athlon_3150g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:athlon_3150g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_3_5425c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_3_5425c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_3_5425u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_3_5425u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_2500u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_2500u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_2600_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_2600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_2600h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_2600h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_2600x_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_2600x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5560u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5560u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5600h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5600h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5600hs_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5600hs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5600u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5600u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5600x_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5600x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5625c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5625c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5625u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5625u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5700g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5700g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_5_5700ge_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_5_5700ge:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_2700u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_2700u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_2700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_2700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_2700x_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_2700x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_2800h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_2800h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_5800h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_5800h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_5800hs_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_5800hs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_5800u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_5800u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_5825c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_5825c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_7_5825u_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_7_5825u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_9_5980hx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_9_5980hx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_9_5980hs_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_9_5980hs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_9_5900hx_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_9_5900hx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_9_5900hs_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_9_5900hs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26361
- 2026-10-03 Alias added: GHSA-vx2p-m3j3-fj93
References
More AMD Athlon 3050ge Firmware vulnerabilities
- TI-2020-10285 Injection in AMD All supported processors CVSS 3.1HIGH 7.5
- TI-2021-08144 Improper input validation in AMD Ryzen 5000 Series CVSS 3.1HIGH 7.8
- TI-2021-08193 Memory corruption in AMD Ryzen™ Series CVSS 3.1HIGH 7.8
- TI-2021-08145 Failure to verify the protocol in SMM may allow an attacker to control the protocol and… CVSS 3.1HIGH 7.8
- TI-2021-08190 An attacker, who gained elevated privileges via some other vulnerability, may be able to… CVSS 3.1HIGH 7.1
- TI-2021-08186 A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed… CVSS 3.1HIGH 7.1
Sources
- CVE-2021-26361 · CVE Program
- CVE-2021-26361 · NVD
- FIRST EPSS
- GHSA-vx2p-m3j3-fj93 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences