CVE-2026-19411

Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in Shim Application for UEFI Bootloader

Publication date: 2026-08-10

Last updated on: 2026-08-14

Assigner: redhat-SADP

Description

A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-14

Generated

2026-08-31

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-29

NVD

CVE-2026-19411

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	shim	to 3.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer issue in the shim application of the dp.c library. It occurs when a missing NULL pointer check allows attackers to crash the system by triggering a denial of service attack. This affects systems using the shim application for UEFI bootloader functionality.

Detection Guidance

This vulnerability involves a NULL pointer issue in the shim application of the dp.c library, which could lead to a denial of service. Detection may require checking for the presence of the vulnerable shim application and analyzing its logs or behavior for crashes or unexpected terminations. No specific commands are provided in the context.

Impact Analysis

The vulnerability could allow attackers to cause a denial of service on your system by exploiting the NULL pointer flaw in the shim application. This may result in system crashes or instability, particularly for systems relying on UEFI bootloader functionality.

Compliance Impact

This vulnerability is a NULL pointer issue in the shim application of the dp.c library, enabling denial of service attacks on systems using UEFI bootloaders. It does not directly impact data confidentiality or integrity but could disrupt system availability, which may affect compliance with standards requiring high availability like HIPAA for healthcare systems.

Mitigation Strategies

Update the shim application in your UEFI bootloader to the latest patched version. Monitor system logs for crashes or denial of service attempts related to the dp.c library. Ensure secure boot is enabled to prevent unauthorized bootloader modifications.

Hi! I’m here to help you understand CVE-2026-19411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70