Description
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability.
Published: 2026-10-05
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution during boot
Action: Assess Impact
AI Analysis

Impact

An insufficient boundary check in the USB boot mode of AMD Versal Adaptive SoC devices can be triggered when the mode is enabled through board modifications. Crafted images loaded during boot may overflow a buffer and overwrite an active function pointer, enabling arbitrary code execution. The attacker could then subvert confidentiality, integrity, and availability of the system.

Affected Systems

The vulnerability affects AMD Alveo Accelerator Cards and several Versal Adaptive SoC families, including the Versal Premium, Prime, RF, AI Core, AI Edge, HBM, and Versal Premium Series Gen 2 (2VP3402, 2VP3502, 2VP3602). No specific firmware or hardware revisions are listed.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is not available, suggesting uncertainty about exploit frequency. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the USB boot process; an attacker would need to supply a crafted image and have physical or board‑based access to enable USB boot mode.

Generated by OpenCVE AI on October 5, 2026 at 22:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable USB boot mode unless absolutely required, or ensure it is configured to prevent untrusted image loading.
  • Only load firmware images that are cryptographically signed by AMD and verified before boot.
  • Implement boot‑time integrity monitoring and restrict physical access to prevent tampering with board settings or firmware.

Generated by OpenCVE AI on October 5, 2026 at 22:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Amd
Amd alveo Accelerator Cards
Amd versal Ai Core Series Adaptive Socs
Amd versal Ai Edge Series Adaptive Socs
Amd versal Hbm Series Adaptive Socs
Amd versal Premium Series Adaptive Socs
Amd versal Premium Series Gen 2 Adaptive Socs
Amd versal Prime Series Adaptive Socs
Amd versal Rf Series Adaptive Socs
Vendors & Products Amd
Amd alveo Accelerator Cards
Amd versal Ai Core Series Adaptive Socs
Amd versal Ai Edge Series Adaptive Socs
Amd versal Hbm Series Adaptive Socs
Amd versal Premium Series Adaptive Socs
Amd versal Premium Series Gen 2 Adaptive Socs
Amd versal Prime Series Adaptive Socs
Amd versal Rf Series Adaptive Socs

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 05 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title Insufficient USB boot boundary check enabling buffer overflow and arbitrary code execution

Mon, 05 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability.
Weaknesses CWE-787
References
Metrics cvssV4_0

{'score': 5.4, 'vector': 'CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}

Subscriptions

Amd Alveo Accelerator Cards Versal Ai Core Series Adaptive Socs Versal Ai Edge Series Adaptive Socs Versal Hbm Series Adaptive Socs Versal Premium Series Adaptive Socs Versal Premium Series Gen 2 Adaptive Socs Versal Prime Series Adaptive Socs Versal Rf Series Adaptive Socs
cve-icon MITRE

Status: PUBLISHED

Assigner: AMD

Published:

Updated: 2026-10-06T13:49:53.907Z

Reserved: 2025-12-06T15:11:34.516Z

Link: CVE-2026-0482

cve-icon Vulnrichment

Updated: 2026-10-06T13:49:45.955Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-05T22:16:56.210

Modified: 2026-10-06T16:00:36.547

Link: CVE-2026-0482

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:56:40Z

Weaknesses