CVE-2026-0461

Severity: high (CVSS 7.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-05 · updated 2026-10-06
Weakness: CWE-787

Description

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.

Affected products

AMD Kria SOMs: all versions
AMD Zynq™ UltraScale+ MPSoCs: all versions
AMD Zynq™ UltraScale+ RFSoCs: all versions

References

https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8029.html

Get alerted when CVE-2026-0461 or the next vulnerability affects your stack