NULL Pointer Vulnerability in UEFI Bootloader Shim Application by Red Hat
CVE-2026-19411

3.9LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
10 August 2026

What is CVE-2026-19411?

A NULL pointer vulnerability has been identified in the shim application of the dp.c library used for UEFI bootloading. This flaw arises from a missing NULL pointer check, which may allow attackers to execute a denial of service attack, leading to system instability or crashes for environments relying on this application.

References

https://access.redhat.com/security/cve/CVE-2026-19411
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2513060
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.9
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.