CVE-2021-26388
MEDIUMCVSS 5.5/10EPSS 0.21%
Last modified
CVE-2021-26388 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Amd | Epyc 7232p Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7302p Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7402p Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7502p Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7702p Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7252 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7262 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7272 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7282 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7302 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7352 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7402 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7452 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7502 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7532 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7542 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7552 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7642 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7662 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7702 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7742 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7f32 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7f52 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7f72 Firmware | < romepi-sp3_1.0.0.d |
| Amd | Epyc 7313p Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7443p Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7543p Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7713p Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7773x Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7763 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7713 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7663 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7643 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7573x Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 75f3 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7513 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7473x Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7453 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 74f3 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7413 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 73f3 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7373x Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 7343 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Epyc 72f3 Firmware | < milanpi-sp3_1.0.0.7 |
| Amd | Ryzen 7 2700x Firmware | < comboam4_v2_pi_1.2.0.6c |
| Amd | Ryzen 7 2700x Firmware | < comboam4pi_1.0.0.8 |
| Amd | Ryzen 7 2700 Firmware | < comboam4pi_1.0.0.8 |
| Amd | Ryzen 7 2700 Firmware | < comboam4_v2_pi_1.2.0.6c |
| Amd | Ryzen 5 2600x Firmware | < comboam4_v2_pi_1.2.0.6c |
| Amd | Ryzen 5 2600x Firmware | < comboam4pi_1.0.0.8 |
Showing 50 of 154 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-26388?
Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.
How severe is CVE-2021-26388?
CVE-2021-26388 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2021-26388?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-26382An attacker with root account privileges can load any legiti…4.4
- CVE-2021-26383Insufficient bounds checking in AMD TEE (Trusted Execution E…7.9
- CVE-2021-26384A malformed SMI (System Management Interface) command may al…7.8
- CVE-2021-26385Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-26386A malicious or compromised UApp or ABL may be used by an att…7.8
- CVE-2021-26387Insufficient access controls in ASP kernel may allow a privi…3.9
- CVE-2021-26390A malicious or compromised UApp or ABL may coerce the bootlo…6.2
- CVE-2021-26391Insufficient verification of multiple header signatures whil…7.8
- CVE-2021-26392Insufficient verification of missing size check in 'LoadModu…7.8
- CVE-2021-26393Insufficient memory cleanup in the AMD Secure Processor (ASP…5.5
- CVE-2021-26396Insufficient validation of address mapping to IO in ASP (AMD…4.4
- CVE-2021-26397Insufficient address validation, may allow an attacker with …7.1
Are you affected by CVE-2021-26388?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST