CVE-2026-14296
Received Received - Intake

MCUboot Boot Selection Flaw in Direct XIP Update

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: 30a5e7fb-040d-440a-8cdf-a4a2068ce72e

Description
When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. The MCUboot in the bare (upstream) configuration assumes that if there is at least a single slot for each image available, the system is bootable and continues the boot process. This may lead to a situation when MCUboot picks different slot for different images (i.e. (a) for the main application and (b) for the radio image), boots the main application (from slot (a)) that afterwards starts the radio image by providing an address of the unauthenticated slot ((a) instead of (b)).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-14296
EUVD
EUVD-2026-72297

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs when using the Direct XIP update strategy in MCUboot. The main application image starts other cores like the radio core without proper verification. MCUboot assumes the system is bootable if at least one slot per image exists, but it may select different slots for different images. This can cause the main application to boot from one slot and then start the radio image from an unauthenticated slot, leading to potential security risks.

Detection Guidance

This vulnerability involves MCUboot selecting mismatched slots for different images during boot, leading to unauthenticated execution. Detection requires checking bootloader logs and image slot configurations for inconsistencies between the main application and radio images. Review MCUboot logs for slot selection mismatches and verify that active slots for all images are properly authenticated.

Impact Analysis

This vulnerability could allow an attacker to execute unauthorized code on your system by exploiting the improper slot selection during boot. It may lead to data breaches, system compromise, or unauthorized access to sensitive functions controlled by the radio core or other started cores.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information security). Organizations using affected systems may face legal penalties, reputational damage, and increased scrutiny from regulators.

Mitigation Strategies

Ensure MCUboot uses consistent slot selection for all images during Direct XIP updates. Verify that the main application and radio image slots are correctly aligned to prevent unauthenticated slot usage. Review bootloader configurations to enforce strict slot verification.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14296. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart