diff --git a/3rdparty/vboot b/3rdparty/vboot
index c0cb4bfa74..7c3b60bb66 160000
--- a/3rdparty/vboot
+++ b/3rdparty/vboot
@@ -1 +1 @@
-Subproject commit c0cb4bfa743c5f0e4a70e2c1a4d063e0b4178ea9
+Subproject commit 7c3b60bb667f917525b5472f6a34df6402d7fa58
diff --git a/src/soc/amd/common/psp_verstage/vboot_crypto.c b/src/soc/amd/common/psp_verstage/vboot_crypto.c
index 5ed351b604..370416f8f7 100644
--- a/src/soc/amd/common/psp_verstage/vboot_crypto.c
+++ b/src/soc/amd/common/psp_verstage/vboot_crypto.c
@@ -135,17 +135,17 @@ vb2_error_t vb2ex_hwcrypto_digest_finalize(uint8_t *digest, uint32_t digest_size
 
 vb2_error_t vb2ex_hwcrypto_modexp(const struct vb2_public_key *key,
 				  uint8_t *inout,
-				  uint32_t *workbuf32, int exp)
+				  void *workbuf, size_t workbuf_size,
+				  int exp)
 {
-	/* workbuf32 is guaranteed to be a length of
-	 * 3 * key->arrsize * sizeof(uint32_t).
+	/*
 	 * Since PSP expects everything in LE and *inout is BE array,
 	 * we'll use workbuf for temporary buffer for endian conversion.
 	 */
 	struct mod_exp_params mod_exp_param;
 	unsigned int key_bytes = key->arrsize * sizeof(uint32_t);
-	uint32_t *sig_swapped = workbuf32;
-	uint32_t *output_buffer = &workbuf32[key->arrsize];
+	uint32_t *sig_swapped = workbuf;
+	uint32_t *output_buffer = &sig_swapped[key->arrsize];
 	uint32_t *inout_32 = (uint32_t *)inout;
 	uint32_t retval;
 	uint32_t i;
@@ -157,6 +157,9 @@ vb2_error_t vb2ex_hwcrypto_modexp(const struct vb2_public_key *key,
 		return VB2_ERROR_EX_HWCRYPTO_UNSUPPORTED;
 	}
 
+	if ((void *)&output_buffer[key->arrsize] - workbuf > workbuf_size)
+		return VB2_ERROR_WORKBUF_SMALL;
+
 	for (i = 0; i < key->arrsize; i++)
 		sig_swapped[i] = swab32(inout_32[key->arrsize - i - 1]);