CVE-2021-46760: AMD Ryzen 3945wx Firmware

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code execution.

Affected products

• AMD Ryzen 3945wx Firmware: version castlepeakwspi-swrx8_1.0.0.9 only; version chagallwspi-swrx8_1.0.0.2 only; version castlepeakpi-sp3r3_1.0.0.7 only
• AMD Ryzen 3955wx Firmware: version castlepeakwspi-swrx8_1.0.0.9 only; version chagallwspi-swrx8_1.0.0.2 only; version castlepeakpi-sp3r3_1.0.0.7 only
• AMD Ryzen 3960x Firmware: version castlepeakwspi-swrx8_1.0.0.9 only; version chagallwspi-swrx8_1.0.0.2 only; version castlepeakpi-sp3r3_1.0.0.7 only
• AMD Ryzen 3970x Firmware: version castlepeakwspi-swrx8_1.0.0.9 only; version chagallwspi-swrx8_1.0.0.2 only; version castlepeakpi-sp3r3_1.0.0.7 only
• AMD Ryzen 3975wx Firmware: version castlepeakwspi-swrx8_1.0.0.9 only; version chagallwspi-swrx8_1.0.0.2 only; version castlepeakpi-sp3r3_1.0.0.7 only
• AMD Ryzen 3990x Firmware: version castlepeakwspi-swrx8_1.0.0.9 only; version chagallwspi-swrx8_1.0.0.2 only; version castlepeakpi-sp3r3_1.0.0.7 only
• AMD Ryzen 3995wx Firmware: version castlepeakwspi-swrx8_1.0.0.9 only; version chagallwspi-swrx8_1.0.0.2 only; version castlepeakpi-sp3r3_1.0.0.7 only

Published 2023-05-09. Last modified 2026-06-17.