CVE-2021-27208: Xilinx Zynq-7000 Firmware

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

When booting a Zync-7000 SOC device from nand flash memory, the nand driver in the ROM does not validate the inputs when reading in any parameters in the nand’s parameter page. IF a field read in from the parameter page is too large, this causes a buffer overflow that could lead to arbitrary code execution. Physical access and modification of the board assembly on which the Zynq-7000 SoC device mounted is needed to replace the original NAND flash memory with a NAND flash emulation device for this attack to be successful.

Affected products

• Xilinx Zynq-7000 Firmware: affected versions not specified
• Xilinx Zynq-7000s Firmware: affected versions not specified

Published 2021-03-15. Last modified 2026-06-17.