Skip to content
Fencer Vulns
medium 6.1

CVE-2021-46758 json

Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory ma…

published 2023-11-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2021-33414

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory mapped beyond SPI flash resulting in a potential loss of availability and integrity.

Patch / fix

  • amd ryzen_7_5700g_firmware comboam4v2_pi_1.2.0.8
  • amd ryzen_7_5700ge_firmware comboam4v2_pi_1.2.0.8
  • amd ryzen_5_5600g_firmware comboam4v2_pi_1.2.0.8
  • amd ryzen_5_5600ge_firmware comboam4v2_pi_1.2.0.8
  • amd ryzen_3_5300g_firmware comboam4v2_pi_1.2.0.8
  • amd ryzen_3_5300ge_firmware comboam4v2_pi_1.2.0.8
  • amd ryzen_9_7950x3d_firmware comboam5_1.0.0.1
  • amd ryzen_9_7900x3d_firmware comboam5_1.0.0.1
  • amd ryzen_7_7800x3d_firmware comboam5_1.0.0.1
  • amd ryzen_9_4900h_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_9_4900hs_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_7_4800h_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_7_4800hs_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_7_4980u_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_7_4800u_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_7_4700u_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_5_4600h_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_5_4600hs_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_5_4680u_firmware renoirpi-fp6_1.0.0.a
  • amd ryzen_5_4600u_firmware renoirpi-fp6_1.0.0.a

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

  • AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Graphics “Cezanne”
  • AMD Ryzen™ 7000 Series Desktop Processors “Raphael” XD3
  • AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics “Renoir” FP6
  • AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Lucienne”
  • AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics “Cezanne”
  • AMD AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics "Rembrandt"
  • AMD AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics “Rembrandt-R”
  • AMD AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics “Barcelo”
  • AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics “Barcelo-R”

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.