CVE-2026-0461 in Zynq UltraScale+ MPSoC
Summary
by MITRE • 10/06/2026
Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within AMD Zynq UltraScale+ MPSoC and RFSoC devices stems from a critical failure in boundary validation logic specifically located within the USB boot mode implementation. During the initial stages of device startup, these systems rely on the First Stage Boot Loader (FSBL) to initialize hardware components and load subsequent software images into memory. The FSBL operates with high privileges and resides in a specific region of system memory that is intended for trusted execution only. However, when the device enters USB boot mode, it accepts Device Firmware Upgrade requests from an external host via Universal Serial Bus connections. In this scenario, the firmware fails to adequately verify the size or boundaries of incoming data packets before writing them into the Dynamic Random-Access Memory DDR receive buffer. This lack of rigorous input validation creates a classic buffer overflow condition where maliciously crafted USB descriptors can exceed the allocated memory space designated for temporary storage during the transfer process.
The technical flaw allows an attacker to craft unbounded DFU download requests that, when processed by the vulnerable firmware, cause data to spill over from the DDR receive buffer into adjacent memory regions occupied by the FSBL code and its associated stack or heap structures. Because the boot sequence is a privileged operation where security checks are often minimized for performance reasons, this overflow can overwrite critical control flow instructions or return addresses within the FSBL environment. By carefully manipulating the payload sent through the USB interface, an attacker can achieve arbitrary code execution at one of the earliest stages of the system's lifecycle. This capability effectively bypasses many standard runtime protections because the exploitation occurs before higher-level operating systems and security modules are fully initialized and active.
The operational impact of this vulnerability is severe due to its location in the boot chain. Successful exploitation grants an attacker full control over the device during the critical transition from hardware initialization to software loading. This compromises the confidentiality, integrity, and availability of the entire system. An adversary could inject malicious firmware that persists across reboots, install rootkits that are difficult to detect by standard antivirus solutions, or manipulate cryptographic keys stored in secure elements if accessible at this stage. Furthermore, because the attack vector is USB-based, it requires physical access or a compromised host machine connected via USB, making it particularly dangerous for embedded systems deployed in field environments where physical security might be less stringent than in data centers. The integrity of any application running on the Zynq device is fundamentally undermined if the boot loader itself has been subverted, as all subsequent software execution inherits this compromise.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. AMD has released updated firmware versions that implement strict boundary checks for USB DFU requests, ensuring that data lengths are validated against buffer limits before any memory write operations occur. System administrators should immediately apply these vendor-provided patches to all affected Zynq UltraScale+ MPSoC and RFSoC devices in production environments. Additionally, organizations should enforce physical security controls around development boards and field-deployed units to prevent unauthorized USB connections from untrusted hosts during the boot process. Implementing secure boot mechanisms that verify digital signatures of the FSBL and subsequent images can also help detect if a compromised version has been loaded, although this does not prevent the initial exploitation but rather limits its persistence or impact on downstream components.
From a classification perspective, this vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and CWE-20 Improper Input Validation which describes the failure to verify that input data conforms to expected constraints before processing it. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit technique relates to T1587 Develop Capabilities involving firmware or hardware implants and potentially T1609 Install Software if the attacker uses the compromised boot loader to install persistent malicious software. The attack also touches upon privilege escalation concepts found in T1068 Exploitation for Privilege Escalation since gaining control of the FSBL provides elevated privileges over the entire system stack. Understanding these mappings helps security teams prioritize patching efforts and monitor for indicators of compromise that may indicate attempts to exploit this specific boot-time vulnerability vector in embedded Linux or RTOS environments running on AMD Xilinx silicon.