CVE-2026-0461: AMD Zynq UltraScale+ Buffer Overflow Vulnerability

CVE-2026-0461 Overview

CVE-2026-0461 is a high-severity out-of-bounds write vulnerability [CWE-787] affecting AMD Zynq UltraScale+ MPSoC and RFSoC devices. The flaw resides in the USB boot mode implementation. Insufficient boundary validation allows unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into First Stage Boot Loader (FSBL) memory. An attacker with local USB access during the boot process can corrupt adjacent FSBL memory regions. This may lead to unauthorized code execution during device initialization, compromising confidentiality, integrity, and availability of the affected system.

Critical Impact
Successful exploitation enables arbitrary code execution within the FSBL context, undermining the secure boot chain of trust on AMD Zynq UltraScale+ MPSoC and RFSoC platforms.

Affected Products

AMD Zynq UltraScale+ MPSoC devices (USB boot mode)
AMD Zynq UltraScale+ RFSoC devices (USB boot mode)
First Stage Boot Loader (FSBL) implementations shipping with affected platforms

Discovery Timeline

2026-10-05 - CVE-2026-0461 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-0461

Vulnerability Analysis

The vulnerability exists in the USB boot path of AMD Zynq UltraScale+ MPSoC and RFSoC silicon. During USB boot, the boot ROM accepts firmware images over the Device Firmware Upgrade (DFU) protocol and stages them in a DDR receive buffer prior to execution. The implementation fails to enforce an upper bound on the cumulative size of DFU download requests. An attacker supplying an oversized image writes past the end of the receive buffer and into memory regions occupied by the FSBL. Because the FSBL executes immediately after the boot ROM, corrupting its code or data allows the attacker to subvert the earliest executable stage of the secure boot chain.

Root Cause

The defect is an out-of-bounds write classified under [CWE-787]. The DFU handler does not validate that incoming transfer lengths remain within the allocated DDR buffer. Without this bounds check, write operations continue linearly into neighboring FSBL memory, allowing attacker-controlled bytes to overwrite boot loader instructions and metadata.

Attack Vector

Exploitation requires local physical access to the device during boot, with the target configured for USB boot mode. The attacker connects to the USB interface and issues crafted DFU download transactions that exceed the receive buffer capacity. See the AMD Security Bulletin #8029 for vendor technical details on the affected boot flow and mitigation guidance.

Detection Methods for CVE-2026-0461

Indicators of Compromise

Unexpected boot failures, hangs, or watchdog resets occurring during the FSBL stage on devices booting via USB.
Devices entering USB boot mode outside of documented provisioning or manufacturing workflows.
Modified or unsigned FSBL images observed on hardware that previously enforced authenticated boot.

Detection Strategies

Enable and monitor authenticated boot features so that any tampering with FSBL contents produces a verifiable signature failure at boot.
Audit boot mode strap configurations across the fleet to identify devices inadvertently left in USB boot mode.
Collect and review boot-stage logs from JTAG, UART, or platform management controllers for anomalies in DFU transfer sizes.

Monitoring Recommendations

Treat any physical USB connection to production MPSoC or RFSoC devices as a security event and alert on it.
Correlate hardware tamper sensors and chassis intrusion events with boot anomalies to catch exploitation attempts.
Maintain inventories of device firmware versions and FSBL hashes, and reconcile them during routine attestation cycles.

How to Mitigate CVE-2026-0461

Immediate Actions Required

Apply the firmware and FSBL updates referenced in AMD Security Bulletin #8029 as soon as they are available for your platform.
Disable USB boot mode on production devices that do not require it, using eFUSE or boot mode strap configuration.
Enforce hardware root-of-trust and authenticated boot so that an attacker-modified FSBL fails signature verification.

Patch Information

AMD has published remediation guidance in AMD Security Bulletin #8029. Operators should consult the bulletin for the specific silicon revisions, FSBL versions, and Vitis or PetaLinux release trains that contain the corrected boundary validation logic.

Workarounds

Restrict physical access to deployed MPSoC and RFSoC hardware, as exploitation requires local USB connectivity during boot.
Permanently blow eFUSEs that disable USB boot on devices that are provisioned exclusively from eMMC, QSPI, or SD storage.
Enable Secure Boot and hardware-enforced encryption of boot images to constrain the impact of FSBL memory corruption.

bash

# Configuration example: enforce authenticated boot and disable USB boot mode
# Consult the AMD Zynq UltraScale+ TRM (UG1085) and Security Bulletin #8029
# before applying eFUSE changes - these operations are irreversible.

# 1. Generate signed boot image with authentication enabled
bootgen -arch zynqmp -image boot.bif -w -o BOOT.bin

# Example boot.bif enforcing RSA authentication:
#   the_ROM_image:
#   {
#       [auth_params] ppk_select=0; spk_id=0x0
#       [pskfile] primary_key.pem
#       [sskfile] secondary_key.pem
#       [bootloader, authentication=rsa] fsbl.elf
#   }

# 2. Program authentication-required eFUSE and disable JTAG/USB boot
#    (requires appropriate hardware access and provisioning tooling)