Raspberry Pi EEPROM CVE-2026-13199

The device must be a Raspberry Pi 5 or Compute Module 5 running an affected EEPROM firmware version - no special configuration or non-default feature is required; the insufficient entropy is unconditional in the vulnerable firmware. Exploitation of this vulnerability alone yields only predictable kernel addresses (information disclosure); achieving code execution requires a separate, co-exploitable kernel memory-corruption vulnerability. Local access to the device is required to leverage the predictable KASLR offset in a practical attack, as confirmed by AV:L in the CVSS 4.0 vector. Authentication requirements are not independently confirmed from the available CVSS data beyond the local-access vector (PR:N/AV:L in CVSS 4.0).

The CVSS 4.0 score of 5.1 with a local attack vector (AV:L) correctly reflects that this is a security-weakening vulnerability rather than a direct exploitation primitive. The low confidentiality impact (VC:L) captures the kernel address disclosure angle; integrity and availability are unaffected (VI:N/VA:N). EPSS data was not provided, and the absence of a KEV listing and confirmed public exploit code further supports a measured assessment - this is not a fire-drill vulnerability in isolation. The realistic risk is as a force multiplier: an attacker who already has a memory-corruption vulnerability targeting these devices gains a significant advantage because KASLR, normally a probabilistic barrier, becomes effectively neutralized. For deployments where Raspberry Pi 5 or Compute Module 5 devices are exposed to untrusted local users or run security-sensitive workloads, the risk elevation is meaningful. For typical hobbyist or isolated IoT deployments, the exploitability remains low without a co-exploitable kernel bug. No CVSS 3.x vector was provided by NVD - the 5.1 score is based on CVSS 4.0 only.

An attacker with local shell access to an unpatched Raspberry Pi 5 determines the device's firmware version, then uses the known-deterministic KASLR seed to calculate exact kernel symbol addresses. Armed with these addresses, they construct a ROP chain for a separate kernel vulnerability - one that would otherwise be defeated by KASLR - and escalate to ring-0 privileges. No public exploit code combining these steps has been identified at time of analysis.