AMD Versal SoCs CVE-2026-0482

Exploitation requires ALL of the following: (1) physical access to the device (CVSS AV:P); (2) the board to be physically modified to enable USB boot mode - this is explicitly NOT a default configuration, per the AMD description ('when enabled through board modifications'); (3) the attacker to supply a crafted/malformed boot image over USB that triggers the out-of-bounds write (CWE-787) during boot. Strong limiting factors: standard unmodified boards do not expose the vulnerable USB boot path at all; high attack complexity (AC:H) indicates the overflow/function-pointer overwrite is not trivially reliable; and exploitation is confined to the one-time boot process rather than a persistent runtime service. These conditions confine realistic risk to supply-chain, manufacturing, or evil-maid contexts where an adversary can physically alter and boot the hardware.

This is a genuinely LOW real-world priority despite a RCE-during-boot technical impact, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:P/AC:H/AT:N/PR:N/UI:N) is the dominant constraint: exploitation requires PHYSICAL access to the device AND high attack complexity, which AMD scored at 5.4 (Medium) precisely because the high vulnerable-system impact (VC:H/VI:H/VA:H) is gated behind physical presence and non-default hardware. No EPSS score, no KEV listing, and no public exploit were provided, so there is no evidence of exploitation probability - consistent with a physical-access boot flaw that cannot be exploited remotely or at scale. The description adds a critical gate not fully captured by CVSS alone: USB boot mode must be 'enabled through board modifications,' meaning the vulnerable code path does not exist on a standard, unmodified board. This makes the flaw effectively a targeted/supply-chain or evil-maid concern (an attacker who can physically alter the board and feed crafted boot images) rather than a widespread threat. No SSVC decision data was provided. Bottom line: a high technical impact tempered by physical access, high complexity, and a non-default board modification - not an urgent patch-now item for typical deployments, but relevant where devices are physically exposed or in untrusted supply chains.

An attacker with physical access to a Versal Adaptive SoC device (or an accelerator board during manufacturing, transit, or deployment) first makes the board modifications required to enable USB boot mode, then connects a malicious USB source serving a crafted boot image. The oversized/malformed image overflows a buffer during the boot-time parsing, overwriting an active function pointer and redirecting execution to attacker-controlled code during the boot process. No public exploit identified at time of analysis, and the high attack complexity plus required hardware modification make this a targeted, hands-on operation.