CVE-2021-26391

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-09 · updated 2026-06-17
Weakness: CWE-347

Description

Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to gain code execution in that TA or the OS/kernel.

Affected products

AMD Enterprise Driver: before 22.10.20 — fixed in 22.10.20
AMD Radeon Pro Software: before 22.q2 — fixed in 22.q2
AMD Radeon Rx Vega 56 Firmware: all versions
AMD Radeon Rx Vega 64 Firmware: all versions
AMD Radeon Software: before 22.5.2 — fixed in 22.5.2
AMD Ryzen 3 5300G Firmware: all versions
AMD Ryzen 3 5300Ge Firmware: all versions
AMD Ryzen 3 5300U Firmware: all versions
AMD Ryzen 3 5400U Firmware: all versions
AMD Ryzen 5 5500U Firmware: all versions
AMD Ryzen 5 5560U Firmware: all versions
AMD Ryzen 5 5600G Firmware: all versions
AMD Ryzen 5 5600Ge Firmware: all versions
AMD Ryzen 5 5600H Firmware: all versions
AMD Ryzen 5 5600Hs Firmware: all versions
AMD Ryzen 5 5600U Firmware: all versions
AMD Ryzen 7 5700G Firmware: all versions
AMD Ryzen 7 5700Ge Firmware: all versions
AMD Ryzen 7 5700U Firmware: all versions
AMD Ryzen 7 5800H Firmware: all versions
AMD Ryzen 7 5800Hs Firmware: all versions
AMD Ryzen 7 5800U Firmware: all versions
AMD Ryzen 9 5900Hs Firmware: all versions
AMD Ryzen 9 5900Hx Firmware: all versions
AMD Ryzen 9 5980Hs Firmware: all versions
AMD Ryzen 9 5980Hx Firmware: all versions

How to fix

Upgrade to a fixed version: AMD Enterprise Driver 22.10.20; AMD Radeon Pro Software 22.q2; AMD Radeon Software 22.5.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-26391 or the next vulnerability affects your stack