CVE-2021-26380
📛 CVE Title
(no title)
Description
A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range resulting in loss of integrity.
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2021-26380 on 2026-08-01. Shown when MITRE's text differs from the cvelistV5 mirror.
A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range resulting in loss of integrity.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- critical
- CVSS score
- 9.8 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 9.8 / 10 CRITICAL source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2021-26380
- Linked Threat
- CVE-2021-26380 — CVE-2021-26380
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-15 03:16:20 UTC
- NVD last modified
- 2026-05-15 14:10:17 UTC
- EPSS score
- 0.0002 (probability of exploitation in next 30 days)
- EPSS percentile
- 4.55% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-190
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:08 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2021-13186 - Assigner
- AMD
- Published
- May 15, 2026, 2:25:20 AM
- Updated
- May 15, 2026, 1:21:36 PM
- EUVD base score (CVSS 4.0)
-
1.8 / 10
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.0200
- Vendors
- AMD
- Products
-
AMD Ryzen™ Embedded V3000 Series Processors (patch: EmbeddedPI-FP7r2_0080)AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Picasso") (patch: 120A)AMD Ryzen™ 4000 Series Desktop Processors (patch: ComboAM4v2 PI 1.2.0.5)AMD Radeon™ PRO V520 (patch: Contact your AMD Customer Engineering representative)AMD Radeon™ PRO WX 8000/9000 Series Graphics Cards (patch: AMD Software: PRO Edition 25.Q3 (23.19.23.11 pre-RDNA))AMD Ryzen™ Embedded R2000 Series Processors (patch: EmbeddedR2KPI-FP5_1.0.0.2)AMD Radeon™ PRO W5000 Series Graphics Products (patch: AMD Software: PRO Edition 25.Q3.1 (25.10.32 RDNA))AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (patch: PicassoPI-FP5 1.0.0.E)AMD Ryzen™ Embedded R1000 Series Processors (patch: EmbeddedPI-FP5_1.2.0.A)AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics (patch: RenoirPI-FP6 1.0.0.7)AMD Radeon™ Instinct™ MI25 (patch: Contact your AMD Customer Engineering representative)AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics (patch: ComboAM4v2 PI 1.2.0.5)AMD Radeon™ PRO W6000 Series Graphics Products (patch: AMD Software: PRO Edition 25.Q3.1 (25.10.32 RDNA))AMD Radeon™ PRO V620 (patch: Contact your AMD Customer Engineering representative)AMD Ryzen™ 5000 Series Desktop Processors (patch: ComboAM4 V2 PI 1.2.0.8)AMD Radeon™ RX 5000 Series Graphics Products (patch: AMD Software: Adrenalin Edition 25.10.2 (25.10.33.02 RDNA1/RDNA2))AMD Radeon™ RX 6000 Series Graphics Products (patch: AMD Software: Adrenalin Edition 25.10.2 (25.10.33.02 RDNA1/RDNA2))AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (patch: CezannePI-FP6 1.0.0.6)AMD Ryzen™ Embedded 5000 Series Processors (patch: EmbAM4PI 1.0.0.2)AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (patch: ComboAM4v2 PI 1.2.0.8)AMD Radeon™ PRO VII (patch: AMD Software: PRO Edition 25.Q3 (23.19.23.11 pre-RDNA))AMD Ryzen™ Embedded V2000 Series Processors (patch: EmbeddedPI-FP6_1.0.0.6)AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors (patch: ChagallWSPI-sWRX8 1.0.0.2)AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics (patch: CezannePI-FP6 1.0.0.6)AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed "Raven Ridge") (patch: EmbeddedPI-FP5_1.2.0.A)AMD Radeon™ RX Vega Series Graphics Cards (patch: AMD Software: Adrenalin Edition 25.8.1 (23.19.23.11 pre-RDNA))AMD Radeon™ VII (patch: AMD Software: Adrenalin Edition 25.8.1 (23.19.23.11 pre-RDNA))AMD Ryzen™ 3000 Series Desktop Processors (patch: ComboAM4PI 1.0.0.9/ ComboAM4 V2 PI 1.2.0.8)
- Aliases
-
GHSA-fq4j-p777-724r
ENISA description: A compromised Trusted OS (TOS) driver could issue a malformed call that could potentially allow memory access outside the intended range resulting in loss of integrity.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2021-26380 tenable:nvd.nist.gov
- https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4017.html tenable:www.amd.com
- https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6027.html tenable:www.amd.com
- https://www.cve.org/CVERecord?id=CVE-2021-26380 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.qualys.com
Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.
2026-05-26 02:56 UTC -
web:layerlogix.com
April 2026 Patch Tuesday drops today. Here's what's critical, what to patch first, and how Houston IT teams should handle deployment — including the Secure Boot certificate deadline reminder.
2026-05-26 02:56 UTC -
web:support.microsoft.com
This non-security update for Windows 11, version 25H2 and 24H2 (KB5083631), includes production-quality improvements. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows ...
2026-05-26 02:56 UTC -
web:support.servicenow.com
Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...
2026-05-26 02:56 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-26 02:56 UTC -
web:www.oracle.com
Oracle Critical Patch Update Advisory - January 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...
2026-05-26 02:56 UTC -
web:www.oracle.com
This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.
2026-05-26 02:56 UTC -
web:www.reddit.com
Hello r/sysadmin, I'm u/AutoModerator, and welcome to this month's Patch Megathread! This is the (mostly) safe location to talk about the latest patches, updates, and releases.
2026-05-26 02:56 UTC -
web:www.secpod.com
Oracle has released its Critical Patch Update (CPU) for January 2025, addressing 318 new security patches across various product families, including Oracle Database Server, Oracle MySQL, Oracle Communications, Oracle E-Business Suite, Oracle Fusion Middleware, and more. This update mitigates vulnerabilities in both Oracle code and third-party components. Oracle strongly recommends applying ...
2026-05-26 02:56 UTC -
web:www.securityweek.com
Oracle on Tuesday announced the release of 481 new security patches as part of its April 2026 Critical Patch Update (CPU). Across the 28 product families that received security updates, more than 300 patches address vulnerabilities that are remotely exploitable without authentication.
2026-05-26 02:56 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.