CVE-2021-26388

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
AMD	EPYC™ Processors	various
AMD	Ryzen™ Series	various
AMD	Athlon™ Series	various

References

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027Vendor Advisory
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028Vendor Advisory

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-263906.2A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity o CVE-2021-263917.8Insufficient verification of multiple header signatures while loading a Trusted Application (TA) may allow an attacker with privileges to ga CVE-2021-263927.8Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with pri CVE-2021-263935.5Insufficient memory cleanup in the AMD Secure Processor (ASP) Trusted Execution Environment (TEE) may allow an authenticated attacker with p CVE-2021-263964.4Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest.CVE-2021-263977.1Insufficient address validation, may allow an attacker with a compromised ABL and UApp to corrupt sensitive memory locations potentially res CVE-2021-263987.8Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (A CVE-2021-264004.0AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are opera CVE-2021-264015.6LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.CVE-2021-264027.1Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write par CVE-2021-264036.5Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confide CVE-2021-264045.5Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure.