AMD Zynq UltraScale+ MPSoCs

• CVE-2026-0461 High 7.5 Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow 0.1%
• CVE-2025-48507 High 8.6 The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the a 0.2%
• CVE-2025-0038 Medium 6.6 In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or protected memory spaces resulting in the lo 0.1%