Insufficient boundary validation in the USB boot mode implementation allows an attacker to send unbounded DFU download requests, causing a buffer overflow into the DDR receive buffer and overwriting FSBL memory. This can lead to unauthorized code execution during the system boot, compromising confidentiality, integrity, and availability.

The vulnerability affects AMD Kria System‑on‑Modules, AMD Zynq UltraScale+ MPSoCs, and AMD Zynq UltraScale+ RFSoCs. No specific firmware version ranges were identified in the advisory.

The CVSS score of 7.5 indicates a high risk level, while the absence of an EPSS score limits the available data on current exploitation trends. The vulnerability is listed in no KEV catalog. Attackers would need access to the USB port or a compromised DFU host, making it likely a local attack vector. Successful exploitation could allow the attacker to execute code with boot‑time privileges, potentially compromising the entire device.