NULL Pointer Dereference in Shim Application for UEFI Bootloader

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-19411

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer issue in the shim application of the dp.c library. It occurs when a missing NULL pointer check allows attackers to crash the system by triggering a denial of service attack. This affects systems using the shim application for UEFI bootloader functionality.

Impact Analysis

The vulnerability could allow attackers to cause a denial of service on your system by exploiting the NULL pointer flaw in the shim application. This may result in system crashes or instability, particularly for systems relying on UEFI bootloader functionality.

Mitigation Strategies

Update the shim application in your UEFI bootloader to the latest patched version. Monitor system logs for crashes or denial of service attempts related to the dp.c library. Ensure secure boot is enabled to prevent unauthorized bootloader modifications.

Hi! I’m here to help you understand CVE-2026-19411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70