CVE-2026-0461CWE-787

CVE-2026-0461

published October 6, 2026

CVSS
7.5
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.

The record
Technical detail
CVSS
7.5 · NONE
CVSS v4.0
7.5 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00128 · 2.2th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-10-06T02:16Z
References (1)
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8029.html · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 05 OCT 21:38Z
    Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware…
    cvelistv5