Input Validation Flaw in Google go-attestation Affects Secure Boot Process

CVE-2026-12681

What is CVE-2026-12681?

A vulnerability in Google go-attestation arises from improper validation of an input index in the parseEfiSignatureList() function. The flaw allows an attacker to manipulate vendor bytes in the buffer, potentially appending harmful entries into a trusted SHA256 hash list. This manipulation can lead to a crafted TPM event log that injects arbitrary SHA256 hashes into the verifier's trusted measurement database. Consequently, remote attestation verifiers may incorrectly accept a compromised boot state as secure. This affects go-attestation versions up to 0.6.0, highlighting the importance of timely updates for maintaining secure remote attestation processes.

References