Read the docs
TI-2026-67901 Aliases CVE-2026-0461GHSA-2xg6-gqcc-77jw

Out-of-bounds write in AMD Zynq UltraScale+ USB boot mode

Priority LOW 34CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

AMD Zynq UltraScale+ MPSoCs, Zynq UltraScale+ RFSoCs and Kria SOMs are affected through their USB boot mode implementation. Insufficient boundary validation lets unbounded Device Firmware Upgrade (DFU) download requests overflow the DDR receive buffer into FSBL memory (CWE-787). A local attacker without privileges and without user interaction could trigger unauthorized code execution during the boot process.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00128 2nd percentileScored 2026-11-07
Fix Fixed Zynq™ UltraScale+ MPSoCs (AMD): 2026.1Zynq™ UltraScale+ RFSoCs (AMD): 2026.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AMDZynq™ UltraScale+ MPSoCs—2026.1Patch availableCNA
AMDZynq™ UltraScale+ RFSoCs—2026.1Patch availableCNA
AMDKria SOMs—2026.1Patch availableCNA
  • Zynq™ UltraScale+ MPSoCs VendorAMD Affected — Fixed in 2026.1 Patch available CNA
  • Zynq™ UltraScale+ RFSoCs VendorAMD Affected — Fixed in 2026.1 Patch available CNA
  • Kria SOMs VendorAMD Affected — Fixed in 2026.1 Patch available CNA

Remediation

Affected products are fixed in version 2026.1 for AMD Zynq UltraScale+ MPSoCs, Zynq UltraScale+ RFSoCs and Kria SOMs. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Zynq™ UltraScale+ MPSoCs (AMD) Fixed in 2026.1
  • Fix · CNA Zynq™ UltraScale+ RFSoCs (AMD) Fixed in 2026.1
  • Fix · CNA Kria SOMs (AMD) Fixed in 2026.1

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-0461
  2. 2026-10-06 Alias added: GHSA-2xg6-gqcc-77jw
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-06 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2026-36341 AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization CVSS 4.0CRITICAL 9.2
  • TI-2023-07046 Improper privilege management in AMD Radeon™ RX 5000 Series Graphics Cards CVSS 3.1HIGH 7.8
  • TI-2023-04574 GPU kernel implementations susceptible to memory leak CVSS 3.1MEDIUM 6.5
  • TI-2023-07042 Information disclosure through error messages in AMD Ryzen™ 3000 Series Desktop… CVSS 3.1MEDIUM 5.5
  • TI-2023-23747 PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers… CVSS 3.1MEDIUM 5.3
  • TI-2022-07839 Improper access control in System Management Mode (SMM) may allow an attacker to write to… CVSS 3.1CRITICAL 9.8
See all 508 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences