CVE-2026-14296

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-07

Last updated on: 2026-09-09

Assigner: YesWeHack

Description

When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. The MCUboot in the bare (upstream) configuration assumes that if there is at least a single slot for each image available, the system is bootable and continues the boot process. This may lead to a situation when MCUboot picks different slot for different images (i.e. (a) for the main application and (b) for the radio image), boots the main application (from slot (a)) that afterwards starts the radio image by providing an address of the unauthenticated slot ((a) instead of (b)).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-09

Generated

2026-10-17

AI Q&A

2026-09-07

EPSS Evaluated

2026-10-16

NVD

CVE-2026-14296

EUVD

EUVD-2026-72297

Affected Vendors & Products

Vendor	Product	Version / Range
Nordic	Semiconductor	ASA nRF54H20 3.2
Nordic	Semiconductor	ASA nRF54H20 3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when using the Direct XIP update strategy in MCUboot. The main application image starts other cores like the radio core without proper verification. MCUboot assumes the system is bootable if at least one slot per image exists, but it may select different slots for different images. This can cause the main application to boot from one slot and then start the radio image from an unauthenticated slot, leading to potential security risks.

Detection Guidance

This vulnerability involves MCUboot selecting mismatched slots for different images during boot, leading to unauthenticated execution. Detection requires checking bootloader logs and image slot configurations for inconsistencies between the main application and radio images. Review MCUboot logs for slot selection mismatches and verify that active slots for all images are properly authenticated.

Impact Analysis

This vulnerability could allow an attacker to execute unauthorized code on your system by exploiting the improper slot selection during boot. It may lead to data breaches, system compromise, or unauthorized access to sensitive functions controlled by the radio core or other started cores.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information security). Organizations using affected systems may face legal penalties, reputational damage, and increased scrutiny from regulators.

Mitigation Strategies

Ensure MCUboot uses consistent slot selection for all images during Direct XIP updates. Verify that the main application and radio image slots are correctly aligned to prevent unauthenticated slot usage. Review bootloader configurations to enforce strict slot verification.

Hi! I’m here to help you understand CVE-2026-14296. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70