CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-14296

CVE-2026-14296 affects MCUBoot in its bare (upstream) configuration on the nRF54H20 SoC. When using the Direct XIP update strategy, the main application image can start other cores (e.g., the radio core) by providing an address from an unauthenticated slot, because MCUboot may select different sl...

EUVD-2026-72297

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

PT-2026-86649

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-14296: Improper Verification of Cryptographic Signature

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...