CVE-2021-26365

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-09 · updated 2026-06-17
Weakness: CWE-125

Description

Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents.

Affected products

Amd 3015Ce Firmware: before pollockpi-ft5_1.0.0.3 — fixed in pollockpi-ft5_1.0.0.3
Amd 3015E Firmware: before pollockpi-ft5_1.0.0.3 — fixed in pollockpi-ft5_1.0.0.3
AMD Ryzen 3 2200G Firmware: all versions
AMD Ryzen 3 2200Ge Firmware: all versions
AMD Ryzen 3 2200U Firmware: all versions
AMD Ryzen 3 2300U Firmware: all versions
AMD Ryzen 3 3200G Firmware: all versions
AMD Ryzen 3 3200Ge Firmware: all versions
AMD Ryzen 3 3200U Firmware: before picassopi-fp5_1.0.0.d — fixed in picassopi-fp5_1.0.0.d
AMD Ryzen 3 3250C Firmware: before picassopi-fp5_1.0.0.d — fixed in picassopi-fp5_1.0.0.d
AMD Ryzen 3 3250U Firmware: before picassopi-fp5_1.0.0.d — fixed in picassopi-fp5_1.0.0.d
AMD Ryzen 3 5300G Firmware: before cezannepi-fp6_1.0.0.8 — fixed in cezannepi-fp6_1.0.0.8
AMD Ryzen 3 5300Ge Firmware: before cezannepi-fp6_1.0.0.8 — fixed in cezannepi-fp6_1.0.0.8
AMD Ryzen 3 5300U Firmware: before cezannepi-fp6_1.0.0.8 — fixed in cezannepi-fp6_1.0.0.8
AMD Ryzen 3 Pro 2100Ge Firmware: all versions
AMD Ryzen 3 Pro 3200G Firmware: all versions
AMD Ryzen 3 Pro 3200Ge Firmware: all versions
AMD Ryzen 5 2400G Firmware: all versions
AMD Ryzen 5 2400Ge Firmware: all versions
AMD Ryzen 5 2500U Firmware: all versions
AMD Ryzen 5 2600H Firmware: all versions
AMD Ryzen 5 3400G Firmware: all versions
AMD Ryzen 5 5500 Firmware: all versions
AMD Ryzen 5 5500U Firmware: before cezannepi-fp6_1.0.0.8 — fixed in cezannepi-fp6_1.0.0.8
AMD Ryzen 5 5600 Firmware: all versions
AMD Ryzen 5 5600G Firmware: before cezannepi-fp6_1.0.0.8 — fixed in cezannepi-fp6_1.0.0.8
AMD Ryzen 5 5600Ge Firmware: before cezannepi-fp6_1.0.0.8 — fixed in cezannepi-fp6_1.0.0.8
AMD Ryzen 5 5600X Firmware: all versions
AMD Ryzen 5 6600H Firmware: before rmb_1.0.0.4 — fixed in rmb_1.0.0.4
AMD Ryzen 5 6600Hs Firmware: before rmb_1.0.0.4 — fixed in rmb_1.0.0.4

How to fix

Upgrade to a fixed version: Amd 3015Ce Firmware pollockpi-ft5_1.0.0.3; Amd 3015E Firmware pollockpi-ft5_1.0.0.3; AMD Ryzen 3 3200U Firmware picassopi-fp5_1.0.0.d; AMD Ryzen 3 3250C Firmware picassopi-fp5_1.0.0.d; AMD Ryzen 3 3250U Firmware picassopi-fp5_1.0.0.d; AMD Ryzen 3 5300G Firmware cezannepi-fp6_1.0.0.8; AMD Ryzen 3 5300Ge Firmware cezannepi-fp6_1.0.0.8; AMD Ryzen 3 5300U Firmware cezannepi-fp6_1.0.0.8; AMD Ryzen 5 5500U Firmware cezannepi-fp6_1.0.0.8; AMD Ryzen 5 5600G Firmware cezannepi-fp6_1.0.0.8; AMD Ryzen 5 5600Ge Firmware cezannepi-fp6_1.0.0.8; AMD Ryzen 5 6600H Firmware rmb_1.0.0.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-26365 or the next vulnerability affects your stack