CVE-2021-26365: amd amd_3015ce_firmware Out-of-bounds Read

Vulnerability summary

CVE-2021-26365 is a high (CVSS 8.2) Out-of-bounds Read vulnerability in amd amd_3015ce_firmware. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.1% of scored vulnerabilities.

Timeline

1. 09-05-2023
   PublishedVulnerability first disclosed.
2. 28-01-2025
   Last modifiedVulnerability information updated.

Description

Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.