CVE-2026-19411
3.9
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Summary
A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-476: NULL Pointer Dereference
Workarounds
The code could be modified to include NULL pointer checkers in the code. Before DevicePathToStr : "if (li == NULL || li->FilePath == NULL) return 0;" After DevicePathToStr : "if (bootpath == NULL) return 0;" At error: "if (bootpath != NULL)"
References
- https://access.redhat.com/security/cve/CVE-2026-19411
- https://bugzilla.redhat.com/show_bug.cgi?id=2513060
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.