CVE-2021-26384

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-14 · updated 2026-06-17
Weakness: CWE-125

Description

A malformed SMI (System Management Interface) command may allow an attacker to establish a corrupted SMI Trigger Info data structure, potentially leading to out-of-bounds memory reads and writes when triggering an SMI resulting in a potential loss of resources.

Affected products

AMD Athlon Gold 3150U Firmware: all versions
AMD Athlon Silver 3050U Firmware: all versions
AMD Ryzen 3 2200U Firmware: before comboam4v2_pi_1.2.0.6c — fixed in comboam4v2_pi_1.2.0.6c
AMD Ryzen 3 2300U Firmware: before comboam4v2_pi_1.2.0.6c — fixed in comboam4v2_pi_1.2.0.6c
AMD Ryzen 3 3200U Firmware: all versions
AMD Ryzen 3 3250U Firmware: all versions
AMD Ryzen 3 3300U Firmware: all versions
AMD Ryzen 3 3350U Firmware: all versions
AMD Ryzen 3 3450U Firmware: all versions
AMD Ryzen 3 3500C Firmware: all versions
AMD Ryzen 3 3500U Firmware: all versions
AMD Ryzen 3 3550H Firmware: all versions
AMD Ryzen 3 3580U Firmware: all versions
AMD Ryzen 3 3700C Firmware: all versions
AMD Ryzen 3 3700U Firmware: all versions
AMD Ryzen 3 3750H Firmware: all versions
AMD Ryzen 3 3780U Firmware: all versions
AMD Ryzen 3 5125C Firmware: before cezannepi-fp6_1.0.0.9 — fixed in cezannepi-fp6_1.0.0.9
AMD Ryzen 3 5300G Firmware: before comboam4_v2_pi_1.2.0.6c — fixed in comboam4_v2_pi_1.2.0.6c
AMD Ryzen 3 5300Ge Firmware: before comboam4_v2_pi_1.2.0.6c — fixed in comboam4_v2_pi_1.2.0.6c
AMD Ryzen 3 5400U Firmware: before cezannepi-fp6_1.0.0.9 — fixed in cezannepi-fp6_1.0.0.9
AMD Ryzen 3 5425C Firmware: before cezannepi-fp6_1.0.0.9 — fixed in cezannepi-fp6_1.0.0.9
AMD Ryzen 3 5425U Firmware: before cezannepi-fp6_1.0.0.9 — fixed in cezannepi-fp6_1.0.0.9
AMD Ryzen 5 2500U Firmware: before comboam4v2_pi_1.2.0.6c — fixed in comboam4v2_pi_1.2.0.6c
AMD Ryzen 5 2600 Firmware: before comboam4v2_pi_1.2.0.6c — fixed in comboam4v2_pi_1.2.0.6c
AMD Ryzen 5 2600H Firmware: before comboam4v2_pi_1.2.0.6c — fixed in comboam4v2_pi_1.2.0.6c
AMD Ryzen 5 2600X Firmware: before comboam4v2_pi_1.2.0.6c — fixed in comboam4v2_pi_1.2.0.6c
AMD Ryzen 5 2700 Firmware: before comboam4v2_pi_1.2.0.6c — fixed in comboam4v2_pi_1.2.0.6c
AMD Ryzen 5 2700X Firmware: before comboam4v2_pi_1.2.0.6c — fixed in comboam4v2_pi_1.2.0.6c
AMD Ryzen 5 5560U Firmware: before cezannepi-fp6_1.0.0.9 — fixed in cezannepi-fp6_1.0.0.9

How to fix

Upgrade to a fixed version: AMD Ryzen 3 2200U Firmware comboam4v2_pi_1.2.0.6c; AMD Ryzen 3 2300U Firmware comboam4v2_pi_1.2.0.6c; AMD Ryzen 3 5125C Firmware cezannepi-fp6_1.0.0.9; AMD Ryzen 3 5300G Firmware comboam4_v2_pi_1.2.0.6c; AMD Ryzen 3 5300Ge Firmware comboam4_v2_pi_1.2.0.6c; AMD Ryzen 3 5400U Firmware cezannepi-fp6_1.0.0.9; AMD Ryzen 3 5425C Firmware cezannepi-fp6_1.0.0.9; AMD Ryzen 3 5425U Firmware cezannepi-fp6_1.0.0.9; AMD Ryzen 5 2500U Firmware comboam4v2_pi_1.2.0.6c; AMD Ryzen 5 2600 Firmware comboam4v2_pi_1.2.0.6c; AMD Ryzen 5 2600H Firmware comboam4v2_pi_1.2.0.6c; AMD Ryzen 5 2600X Firmware comboam4v2_pi_1.2.0.6c. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-26384 or the next vulnerability affects your stack