Read the docs
TI-2026-12093 Aliases CVE-2026-14296GHSA-j59p-mqmr-fcgh

nRF54H20: MCUBoot can be tricked to executing unauthenticated code

Priority LOW 34CWE-347Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. The MCUboot in the bare (upstream) configuration assumes that if there is at least a single slot for each image available, the system is bootable and continues the boot process. This may lead to a situation when MCUboot picks different slot for different images (i.e. (a) for the main application and (b) for the radio image), boots the main application (from slot (a)) that afterwards starts the radio image by providing an address of the unauthenticated slot ((a) instead of (b)).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Nordic Semiconductor ASAnRF54H203.2; 3.3—No fix listedCNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14296
  2. 2026-10-03 Alias added: GHSA-j59p-mqmr-fcgh

References

  • TI-2026-12094 Out-of-bounds write in Nordic Semiconductor ASA nRF Connect SDK CVSS 4.0HIGH 8.7
  • TI-2026-15396 QSPI flash encryption side-channel leakage CVSS 4.0MEDIUM 6.8

Sources