{"id":"CVE-2026-14296","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-14296","generatedAt":"2026-10-28T08:10:29.762Z","title":"When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification.","description":"When using the Direct XIP\nupdate strategy, the main application image starts other cores (i.e. radio\ncore), based on the currently active slot without additional verification. The\nMCUboot in the bare (upstream) configuration assumes that if there is at least\na single slot for each image available, the system is bootable and continues\nthe boot process. This may lead to a situation when MCUboot picks different\nslot for different images (i.e. (a) for the main application and (b) for the\nradio image), boots the main application (from slot (a)) that afterwards starts\nthe radio image by providing an address of the unauthenticated slot ((a)\ninstead of (b)).","published":"2026-09-07T08:17:12.000Z","lastModified":"2026-09-09T15:50:19.000Z","status":"Awaiting Analysis","sourceIdentifier":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-347"],"affected":[],"epss":{"score":0.00167,"percentile":0.05935,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html","source":"30a5e7fb-040d-440a-8cdf-a4a2068ce72e"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-14296","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}